CVE-2026-53659 Details
Description
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0.
A denial-of-service vulnerability has been identified in http4k, a toolkit for Kotlin HTTP applications, in versions prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0. The issue arises in the ServerFilters.GZip and RequestFilters.GunZip components, where there was no limit on the size of data that could be decompressed from gzip-encoded request bodies. This lack of restriction allowed an unauthenticated client to send a small gzip-compressed payload that could expand to several gigabytes, consuming excessive JVM heap memory and disrupting service for other clients.
Users can upgrade to http4k versions 4.51.0.0, 5.42.0.0, or 6.49.0.0, where this vulnerability has been fixed. For those who cannot upgrade immediately, it is possible to replace the GZip and GunZip filters with custom versions that limit the size of the decompressed data, or to remove support for gzip-encoded requests at the network edge using a CDN, reverse proxy, or load balancer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4k/http4k/commit/2618fe08f9801353012561ae1f1382fa2d37bac9 | [email protected] | Source CodeVendor |
| https://github.com/http4k/http4k/commit/9f9e02f8efbbe04e0c70f1c46eef5d9d9067ea5b | [email protected] | Source CodeVendor |
| https://github.com/http4k/http4k/releases/tag/6.49.0.0 | [email protected] | Release NotesVendor |
| https://github.com/http4k/http4k/security/advisories/GHSA-g4w2-6h2r-3m3w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| http4k | < 6.49.0.0 < 5.42.0.0 < 4.51.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |