Denial Of Service (DoS)

github.com/tendermint/tendermint is vulnerable to Denial Of Service (DoS). The vulnerability is due to the makeHTTPClient function within http_client.go automatically decompressing Gzip-compressed responses, without limitations on the size or content of the response body. This allows an attacker to craft a zip bomb, which could significantly expand upon decompression and consuming vast amounts of system resources, resulting in Denial Of Service (DoS).