Because of this lack of bounded memory allocation during decompression, an attacker controlling a remote server can provide a highly compressed payload using algorithms like Gzip, Deflate, Brotli, or Zstd. At the maximum compression ratio for DEFLATE, which is approximately 1032:1, a 64 KiB chunk can expand into roughly 64 MiB of memory in a single allocation. Even if the application logic intends to stream data to keep memory usage low, these transient, uncontrolled allocations occur during the underlying decompression phase. This behavior exposes applications that interact with untrusted third-party servers to memory pressure or total service failure via out-of-memory (OOM) termination.

Impact

Applications that fetch resources from untrusted or attacker-influenced origins are at significant risk. This includes webhook receivers, link unfurlers, web crawlers, SSRF-prone services, and automated tools that follow HTTP redirects. Exploitation requires no authentication or user interaction beyond triggering the application to perform an HTTP request to the attacker-controlled server. Successful exploitation results in process crashes or severe performance degradation due to memory exhaustion, effectively causing a denial-of-service.

Recommendation

Prioritize the upgrade of the HTTPX2 library to version 2.12.0 or later across all applications that perform egress HTTP requests to untrusted endpoints. Version 2.12.0 introduces bounded, incremental decompression buffers to prevent uncontrolled memory spikes. Audit internal infrastructure to identify services leveraging HTTPX2 for fetching external resources, particularly in SSRF-sensitive environments, and ensure dependencies are updated via package management tools.