topic Re: Threat Emulation failure "Gzip exceeded maximum decompression ratio" in Firewall and Security Management

Threat Emulation failure "Gzip exceeded maximum decompression ratio"

lraaicfdb — Tue, 30 Sep 2025 15:29:53 GMT

Hello everyone,
our security gateway is currently blocking Google pages from time to time. Threat emulation is stopping traffic with the error: HTTP parsing error occurred - Gzip exceeded maximum decompression ratio.

However, gzip is excluded in the Threat Emulation Blade. Can someone explain the error to me? What decompression ratio are we talking about here?

Thank you!

Re: Threat Emulation failure "Gzip exceeded maximum decompression ratio"

PhoneBoy — Tue, 30 Sep 2025 15:55:23 GMT

gzip in Threat Emulation refers to files with .gz.
What this is referring to is the gzip compression that web servers sometimes do as part of the HTTP connection.

HTTP Parsing Errors are usually triggered by specific inspection settings.
There appears to be one for this:

I don't believe disabling this option is a good idea.
I would check with TAC here.

Re: Threat Emulation failure "Gzip exceeded maximum decompression ratio"

lraaicfdb — Thu, 02 Oct 2025 08:25:27 GMT

I waited a few days with my answer to test the change. Apparently, it was precisely the function that was causing the issue, but the "Inspect compressed HTTP traffic" option wasn't selected (for whatever reason). Since selecting the option and increasing the limit, the messages in log-Files have disappeared and the websites load perfectly. Thank you so much!