From 37cc3548093870b244c1c85eb2c2e067d9ee27aa Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 15 Oct 2026 21:28:11 +0200
Subject: [PATCH] http1: only disable decompression after too many bombs

Ticket: 9200

And to do so, reinit the content_encoding, so that
we do not try to take a decompressor
---
 rust/htp/src/request.rs  | 3 +++
 rust/htp/src/response.rs | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/rust/htp/src/request.rs b/rust/htp/src/request.rs
index bc380f49ab..73c2ce51d5 100644
--- a/rust/htp/src/request.rs
+++ b/rust/htp/src/request.rs
@@ -1253,6 +1253,9 @@ impl ConnectionParser {
         let compression_options = self.cfg.compression_options;
         if self.bombs >= compression_options.get_max_bombs() {
             // skip decompression for this flow if too many bombs were seen
+            self.request_mut()
+                .unwrap()
+                .request_content_encoding_processing = HtpContentEncoding::None;
             return Ok(());
         }
         if encoding != HtpContentEncoding::None {
diff --git a/rust/htp/src/response.rs b/rust/htp/src/response.rs
index 868f7d478e..64ea16cd4e 100644
--- a/rust/htp/src/response.rs
+++ b/rust/htp/src/response.rs
@@ -1337,6 +1337,9 @@ impl ConnectionParser {
         let compression_options = self.cfg.compression_options;
         if self.bombs >= compression_options.get_max_bombs() {
             // skip decompression for this flow if too many bombs were seen
+            self.response_mut()
+                .unwrap()
+                .response_content_encoding_processing = HtpContentEncoding::None;
             return Ok(());
         }
         if encoding != HtpContentEncoding::None {