{"action":"Upgrade org.http4k:http4k-core to 5.42.0.0 (5.x) or 6.49.0.0 (6.x) or later.","affected":[{"fixed":"6.49.0.0","introduced":"6.0.0.0"},{"fixed":"5.42.0.0","introduced":"5.0.0.0"},{"introduced":"0","last_affected":"4.48.2.0"}],"component":"org.http4k:http4k-core","cve_ids":["CVE-2026-53659"],"ecosystem":"Maven","epss":0.0063,"exploited":false,"fixed_versions":["6.49.0.0","5.42.0.0"],"ghsa_id":"GHSA-g4w2-6h2r-3m3w","id":"tcs_01M5N8XAQANY7Y7CGNEJKSQREN","modified_at":"2026-08-17T22:11:01.943230Z","published_at":"2026-08-17T21:52:27Z","references":["https://osv.dev/vulnerability/GHSA-g4w2-6h2r-3m3w","https://github.com/http4k/http4k/security/advisories/GHSA-g4w2-6h2r-3m3w","https://github.com/http4k/http4k","https://github.com/http4k/http4k/releases/tag/6.49.0.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g4w2-6h2r-3m3w","url":"https://osv.dev/vulnerability/GHSA-g4w2-6h2r-3m3w"}],"summary":"http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS"}