Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-53659

http4k · Vulnerability

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-53659

Published

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clients. The fix uses SizeLimitedInputStream to enforce a default 10 MiB limit, causes ServerFilters.GZip and RequestFilters.GunZip to return 413 Request Entity Too Large, and causes other decompression paths to throw SizeLimitExceededException. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.49.0.0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-53659

Published

http4k

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "http4k",
                    "product": "http4k",
                    "versions": [
                        {
                            "version": "< 4.51.0.0",
                            "status": "affected"
                        },
                        {
                            "version": ">= 5.0.0.0, < 5.42.0.0",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0.0, < 6.49.0.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON