GHSA-G4W2-6H2R-3M3W http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

org.http4k:http4k-client-apache (1.10.0), org.http4k:http4k-contract (1.10.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.10.0)

org.http4k:http4k-core MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.10.0 - org.http4k:http4k-contract 1.10.0 - org.http4k:http4k-format-argo 1.10.0 ...

org.http4k:http4k-server-apache (3.229.0), org.http4k:http4k-server-jetty (3.229.0) +1 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.229.0)

org.http4k:http4k-core MAVEN version 3.229.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-server-apache 3.229.0 - org.http4k:http4k-server-jetty 3.229.0 - org.http4k:http4k-server-netty...

org.http4k:http4k-aws (3.172.0), org.http4k:http4k-client-apache (3.172.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.172.0)

org.http4k:http4k-core MAVEN version 3.172.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.172.0 - org.http4k:http4k-client-apache 3.172.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.13.4), org.http4k:http4k-client-apache (3.13.4) +23 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.13.4)

org.http4k:http4k-core MAVEN version 3.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.13.4 - org.http4k:http4k-client-apache 3.13.4 - org.http4k:http4k-client-apache-async 3.13...

org.http4k:http4k-aws (3.251.0), org.http4k:http4k-client-apache (3.251.0) +39 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.251.0)

org.http4k:http4k-core MAVEN version 3.251.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.251.0 - org.http4k:http4k-client-apache 3.251.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.269.0), org.http4k:http4k-client-apache (3.269.0) +44 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.269.0)

org.http4k:http4k-core MAVEN version 3.269.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.269.0 - org.http4k:http4k-client-apache 3.269.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-client-apache (2.0.5), org.http4k:http4k-client-okhttp (2.0.5) +8 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.0.5)

org.http4k:http4k-core MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 2.0.5 - org.http4k:http4k-client-okhttp 2.0.5 - org.http4k:http4k-contract 2.0.5 -...

org.http4k:http4k-client-apache (0.22.0), org.http4k:http4k-contract (0.22.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (0.22.0)

org.http4k:http4k-core MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 0.22.0 - org.http4k:http4k-contract 0.22.0 - org.http4k:http4k-format-argo 0.22.0 ...

org.http4k:http4k-aws (3.31.0), org.http4k:http4k-client-apache (3.31.0) +25 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.31.0)

org.http4k:http4k-core MAVEN version 3.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.31.0 - org.http4k:http4k-client-apache 3.31.0 - org.http4k:http4k-client-apache-async 3.31...

org.http4k:http4k-aws (2.31.4), org.http4k:http4k-client-apache (2.31.4) +16 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.31.4)

org.http4k:http4k-core MAVEN version 2.31.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.31.4 - org.http4k:http4k-client-apache 2.31.4 - org.http4k:http4k-client-okhttp 2.31.4 -...

org.http4k:http4k-aws (2.31.0), org.http4k:http4k-client-apache (2.31.0) +16 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.31.0)

org.http4k:http4k-core MAVEN version 2.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.31.0 - org.http4k:http4k-client-apache 2.31.0 - org.http4k:http4k-client-okhttp 2.31.0 -...

org.http4k:http4k-aws (3.245.1), org.http4k:http4k-client-apache (3.245.1) +34 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.245.1)

org.http4k:http4k-core MAVEN version 3.245.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.245.1 - org.http4k:http4k-client-apache 3.245.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.1.1), org.http4k:http4k-client-apache (3.1.1) +18 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.1.1)

org.http4k:http4k-core MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.1.1 - org.http4k:http4k-client-apache 3.1.1 - org.http4k:http4k-client-okhttp 3.1.1 -...

org.http4k:http4k-aws (3.148.0), org.http4k:http4k-client-apache (3.148.0) +27 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.148.0)

org.http4k:http4k-core MAVEN version 3.148.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.148.0 - org.http4k:http4k-client-apache 3.148.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.123.0), org.http4k:http4k-client-apache (3.123.0) +30 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.123.0)

org.http4k:http4k-core MAVEN version 3.123.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.123.0 - org.http4k:http4k-client-apache 3.123.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.26.4), org.http4k:http4k-client-apache (3.26.4) +25 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.26.4)

org.http4k:http4k-core MAVEN version 3.26.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.26.4 - org.http4k:http4k-client-apache 3.26.4 - org.http4k:http4k-client-apache-async 3.26...

org.http4k:http4k-aws (2.31.1), org.http4k:http4k-client-apache (2.31.1) +16 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.31.1)

org.http4k:http4k-core MAVEN version 2.31.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.31.1 - org.http4k:http4k-client-apache 2.31.1 - org.http4k:http4k-client-okhttp 2.31.1 -...

org.http4k:http4k-aws (2.18.1), org.http4k:http4k-client-apache (2.18.1) +13 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.18.1)

org.http4k:http4k-core MAVEN version 2.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.18.1 - org.http4k:http4k-client-apache 2.18.1 - org.http4k:http4k-client-okhttp 2.18.1 -...

org.http4k:http4k-aws (3.189.0), org.http4k:http4k-client-apache (3.189.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.189.0)

org.http4k:http4k-core MAVEN version 3.189.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.189.0 - org.http4k:http4k-client-apache 3.189.0 - org.http4k:http4k-client-apache-async...