Product
The http4k library fails to limit the size of decompressed gzip data, allowing unauthenticated remote attackers to trigger JVM heap exhaustion via small, highly compressed payloads.