Improper Handling of Highly Compressed Data (Data Amplification) Affecting org.http4k:http4k-core package, versions [,6.49.0.0)

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) through the Body.gunzipped() and Body.gunzippedStream() paths in core/core/src/main/kotlin/org/http4k/filter/Gzip.kt and the RequestFilters.GunZip request filter in core/core/src/main/kotlin/org/http4k/filter/RequestFilters.kt. An attacker can exhaust JVM heap and deny service to other clients by sending a small gzip-encoded request body that expands to an arbitrarily large payload.

Notes

• Additional fixes have been released for 4.x and 5.x streams under LTS for Enterprise, (contact enterprise@http4k.org)

Workarounds

• Replace the GZip / GunZip filters with custom versions that wrap the decompressed InputStream in a size-limited reader, to stop gzip bombs from expanding into enough data to exhaust JVM heap.
• Strip gzip-encoded request support at the edge, such as at a CDN, reverse proxy, or load balancer, to prevent unauthenticated clients from delivering the compressed request bodies that trigger the decompression DoS.

• GitHub Commit
• Maintainer's Advisory