CVE-2026-53659
1 advisory.
Maven/org.http4k:http4k-core CVE-2026-53659: high 7.5
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Action: Upgrade org.http4k:http4k-core to 5.42.0.0 (5.x) or 6.49.0.0 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0.0 | 6.49.0.0 | - |
| 5.0.0.0 | 5.42.0.0 | - |
| 0 | - | 4.48.2.0 |
Fixed versions
| 6.49.0.0 | 5.42.0.0 |
Sources
- osv: GHSA-g4w2-6h2r-3m3w
- https://github.com/http4k/http4k/security/advisories/GHSA-g4w2-6h2r-3m3w
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/releases/tag/6.49.0.0
CVE-2026-53659 · published · modified · JSON