http4k up to 4.50.0.0/5.41.0.0/6.48.0.0 GZip Decompression heap-based overflow

Summaryinfo

A vulnerability classified as problematic was found in http4k up to 4.50.0.0/5.41.0.0/6.48.0.0. Affected by this vulnerability is the function ServerFilters.GZip/RequestFilters.GunZip/Gzip request-body decompression of the component GZip Decompression. Such manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2026-53659. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in http4k up to 4.50.0.0/5.41.0.0/6.48.0.0. Affected by this issue is the function ServerFilters.GZip/RequestFilters.GunZip/Gzip request-body decompression of the component GZip Decompression. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is availability. CVE summarizes:

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-53659 since 06/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 4.51.0.0, 5.42.0.0 or 6.49.0.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• http4k

Version

• 4.50.0
• 5.41.0
• 6.48.0

Website

• Product: https://github.com/http4k/http4k/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion