CVE-2026-53659

http4k, a functional toolkit for Kotlin HTTP applications, fails to limit the decompressed size of gzip-encoded request bodies handled by ServerFilters.GZip, RequestFilters.GunZip, and the underlying decompression functions (CWE-409). An unauthenticated attacker can send a small, highly compressed gzip request body that expands to gigabytes in memory, exhausting the JVM heap and denying service to all other clients. Any application built on http4k versions prior to 4.51.0.0, 5.42.0.0, or 6.49.0.0 that enables gzip handling of inbound request bodies is affected. The fix enforces a default 10 MiB limit via SizeLimitedInputStream, returning 413 Request Entity Too Large (or throwing SizeLimitExceededException on other decompression paths). No public proof of concept exists and the issue is not in the CISA KEV catalog, so exploitation appears theoretical at this time.

What to do: Upgrade to http4k 4.51.0.0, 5.42.0.0, or 6.49.0.0 (the fixed release in your major version line) as soon as possible. If you cannot upgrade immediately, wrap gzip request-body decompression with a size-limited stream (e.g., SizeLimitedInputStream, default 10 MiB) or place a reverse proxy in front that caps request body sizes. Audit whether your application actually applies ServerFilters.GZip or RequestFilters.GunZip to inbound request bodies, since only those decompression paths are vulnerable.