Vulnerability in Gzip Decompression of http4k Toolkit for Kotlin Applications
CVE-2026-53659
What is CVE-2026-53659?
The http4k toolkit for Kotlin applications had a vulnerability in its decompression handling. Prior to versions 4.51.0.0, 5.42.0.0, and 6.49.0.0, the Gzip and GunZip functions did not enforce limits on the size of the decompressed request body. This lack of restriction allowed an unauthenticated client to send a small gzip-encoded request that could expand into a significantly larger payload, potentially exhausting the Java Virtual Machine (JVM) heap memory and leading to service disruptions for other clients. The issue has been addressed by implementing a size limit, prompting the server to return a 413 Request Entity Too Large error for requests exceeding 10 MiB. This fix is critical for maintaining service availability and stability.
Affected Version(s)
http4k < 4.51.0.0 < 4.51.0.0
http4k >= 5.0.0.0, < 5.42.0.0 < 5.0.0.0, 5.42.0.0
http4k >= 6.0.0.0, < 6.49.0.0 < 6.0.0.0, 6.49.0.0