AIKIDO-2026-59285
http4k-core is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
TL;DR
http4k-core decompresses incoming gzip-encoded request bodies through ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip helpers without limiting the decompressed size. A small crafted request body of a few kilobytes can expand to gigabytes and exhaust the JVM heap. An unauthenticated client can trigger this against any server that accepts gzip-encoded requests, denying service to other clients. The fix caps decompression at a configurable default size, returning 413 Request Entity Too Large for oversized requests and throwing SizeLimitExceededException on other decompression paths.
How do I fix this?
Upgrade the org.http4k:http4k-core library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your server decompresses incoming gzip-encoded request bodies via ServerFilters.GZip or RequestFilters.GunZip.
Package
Versions
2.17.0 - 4.48.2.0
Fixed in 4.51.0.05.0.0.0 - 5.41.0.0
Fixed in 5.42.0.06.0.0.0 - 6.48.0.0
Fixed in 6.49.0.0Background info
http4k-core is vulnerable to Denial of Service (DoS) in versions 2.17.0 - 4.48.2.0, 5.0.0.0 - 5.41.0.0 and 6.0.0.0 - 6.48.0.0.
Links
GitHub Release
Fix Commits
github.com/http4k/http4k/commit/2618fe08f9801353012561ae1f1382fa2d37bac9github.com/http4k/http4k/commit/9f9e02f8efbbe04e0c70f1c46eef5d9d9067ea5b
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.