async-http-client decompression bomb DoS (CVE-2025-8721)

Summary of Critical Vulnerability Information Vulnerability Overview Vulnerability Name: HTTP/1.1 Response Decompression Unlimited Size, Leading to Decompression Bomb Denial of Service (DoS) CVE ID: CVE-2025-8721 Severity: High (CVSS v3.1 Score 7.5/10) Advisory ID: GHSA-7grg-jc7f-rpmx Root Cause: When automatic response decompression is enabled (on by default), the HTTP/1.1 path imposes no limit on the total output size during response body decompression. An attacker can send a minimally compressed body (e.g., gzip, deflate, snappy) that expands into a massive response, triggering an and rendering the service unavailable. Affected Scope Affected Package: Affected Versions: - HTTP/1.1: 3.x series (≤ 3.0.11) and 2.x series (≤ 2.16.0) - HTTP/2: The HTTP/2 decompressors in versions 3.0.8, 3.0.9, and 3.10 are also unbounded Trigger Condition: The issue is only triggered when response headers include optional encodings such as . Remediation Patched Versions: - 3.x series: Fixed in 3.0.12 - 2.x series: Fixed in 2.16.1 Interim Workarounds: - In 3.x: Call to disable automatic decompression, and manually decompress using a custom size limit. - In 2.x: There is no corresponding configuration option, and the decompressor is installed unconditionally; it can be mitigated by removing the infilter handler or invoking . Recommendation: Upgrading to 3.0.12 resolves this vulnerability as well as the related CVE-2025-8721-associated issue where the client cannot read a downgrade to Basic and sends the password in cleartext. POC / Exploit Code The advisory does not include a POC or exploit code block, describing the attack vector only in text (constructing a small compressed body to trigger a decompression bomb).

Goal Reached Thanks to every supporter — we hit 100%!

async-http-client decompression bomb DoS (CVE-2025-8721)

More from this source