ETK-2026-4191Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4191",
  "cve_id": null,
  "display_id": "ETK-2026-4191",
  "ghsa_id": "GHSA-hgj7-52cp-647p",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Request decompression memory exhaustion in micronaut-http-server-netty",
  "summary": "Micronaut HTTP Server Netty 5.2.x through 5.2.16 can process compressed request bodies without consistently applying body-size limits or read backpressure. An unauthenticated client able to send compressed requests may consume excessive server memory and disrupt service.",
  "mitigation": "Reject or strip compressed request bodies at an ingress proxy where possible, and restrict unauthenticated access to affected endpoints. Monitor for an updated Micronaut release and upgrade when a vendor-fixed version is published.",
  "vendor": "maven",
  "product": "maven:io.micronaut:micronaut-http-server-netty",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.3.0, <= 5.2.17"
      ],
      "ecosystem": "maven",
      "fixed_versions": [],
      "package_name": "io.micronaut:micronaut-http-server-netty",
      "purl": "pkg:maven/io.micronaut/micronaut-http-server-netty"
    }
  ],
  "cwes": [
    409
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 31.057978816666665,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-11T17:32:53.074926+00:00",
      "days": -0.05503762105324074,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T18:52:08.369145+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T16:31:08+00:00",
      "days": -0.09792043269675926,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T18:52:08.369145+00:00",
      "url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-hgj7-52cp-647p"
    }
  }
}