CVE-2013-3587- enable of HTTP compression

legacy-knowledge-base

公開されました Jun. 30, 2025

written-by

Apsara Raheja

legacy-article

learn-legacy-article-disclaimer-text

Issue

Security vulnerability CVE-2013-3587 details a breach attack that is possible with the enable of HTTP compression and Deflate.

Steps to see the behvaior:

Navigate to any of the pages on the Liferay server.
Inspect the browser, open the network tab request, and check the accept-encoding header value.

The accept-encoding header highlighted in the above snapshot shows the browser’s Accept-Encoding and not DXP’s response which is not controlled from Liferay's end.
Regarding the HTTP compression, check the Tomcat/app server configuration and turn it off from there as well.
Please check the below property present in 'portal-ext.properties', which is disabled by default. If it persists, remove it or make it false.
```
com.liferay.portal.servlet.filters.gzip.GZipFilter=true
```