"ServerFilters.GZip" and "RequestFilters.GunZip" (and the underlying "Gzip" functions used to decompress request bodies) did not impose any cap on the decompressed size. A small malicious gzip-encoded request body (on the order of kilobytes) could decompress to gigabytes, exhausting the JVM heap and denying service to other clients. Who is affected: any http4k server that accepts gzip-encoded requests via "ServerFilters.GZip" or "RequestFilters.GunZip". Exploitable by any unauthenticated client. The vulnerability was introduced on 2017-08-01 (commit "2618fe08f9") and was present for ~9 years.