AIKIDO-2026-59285
http4k-core is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
http4k-coreTL;DR
http4k-core decompresses incoming gzip-encoded request bodies through ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip helpers without limiting the decompressed size. A small crafted request body of a few kilobytes can expand to gigabytes and exhaust the JVM heap. An unauthenticated client can trigger this against any server that accepts gzip-encoded requests, denying service to other clients. The fix caps decompression at a configurable default size, returning 413 Request Entity Too Large for oversized requests and throwing SizeLimitExceededException on other decompression paths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your server decompresses incoming gzip-encoded request bodies via ServerFilters.GZip or RequestFilters.GunZip.
Background info
http4k-core is vulnerable to Denial of Service (DoS) in versions 2.17.0 - 4.48.2.0, 5.0.0.0 - 5.41.0.0 and 6.0.0.0 - 6.48.0.0.
How to fix this
Upgrade the org.http4k:http4k-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant