This vulnerability has existed since 2017 and affects multiple versions across the v4, v5, and v6 branches. Because the library is widely used for building HTTP services, this poses a high risk to applications that expose endpoints accepting compressed inputs. Defenders must prioritize upgrading to the patched versions or implementing protective measures at the network edge to inspect or reject oversized request payloads.

Impact

Successful exploitation results in service unavailability due to JVM OutOfMemory errors. Any application using the affected http4k filters to process incoming requests is susceptible to unauthenticated remote exploitation. Impact is restricted to availability (DoS); there is no evidence of remote code execution or data exfiltration associated with this vulnerability.

Recommendation

• Upgrade http4k-core to the patched versions: 4.51.0.0, 5.42.0.0, or 6.49.0.0 immediately to apply the default 10MB decompression limit.
• Implement request body size limits at the edge (Load Balancer, Reverse Proxy, or WAF) to drop excessively large or potentially malicious compressed requests before they reach the application layer.
• For legacy applications that cannot be updated, implement a custom filter in the http4k pipeline that restricts the size of the InputStream before decompression occurs.