CVE-2026-28975

When "NIOHTTPRequestDecompressor" is configured with ".ratioN", the decompression limit is enforced using the "Content-Length" header value from the incoming request rather than the actual number of compressed bytes received. Since "Content-Length" is attacker-controlled, a malicious client can...

NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

When NIOHTTPRequestDecompressor is configured with .ratioN, the decompression limit is enforced using the Content-Length header value from the incoming request rather than the actual number of compressed bytes received. Since Content-Length is attacker-controlled, a malicious client can supply an...