Maven package
org.http4k/http4k-core
pkg:maven/org.http4k/http4k-core
Vulnerabilities (1)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-53659 | hig | — | >= 6.0.0.0, < 6.49.0.0 | 6.49.0.0 | Aug 17, 2026 | ### Impact `ServerFilters.GZip` and `RequestFilters.GunZip` (and the underlying `Gzip` functions used to decompress request bodies) did not impose any cap on the decompressed size. A small malicious gzip-encoded request body (on the order of kilobytes) could decompress to gigaby |
- affected >= 6.0.0.0, < 6.49.0.0fixed 6.49.0.0
### Impact `ServerFilters.GZip` and `RequestFilters.GunZip` (and the underlying `Gzip` functions used to decompress request bodies) did not impose any cap on the decompressed size. A small malicious gzip-encoded request body (on the order of kilobytes) could decompress to gigaby