Gzip compression is a common method for shrinking web data before it is sent over HTTP. A server or client compresses the payload into a smaller binary form, then the receiver decompresses it back into the original content. This reduces bandwidth use and can speed up transfers, especially for APIs, logs, and configuration data.
In cyber security, gzip matters because compressed traffic changes how requests are inspected and processed. A small compressed request can expand into a much larger payload after decompression, creating a risk of resource exhaustion if size limits are missing or enforced too late. Attackers may abuse this to consume CPU or memory, or to hide malicious content from simple filters. Defenders reduce the risk by setting strict decompression bounds, validating requests before expansion, and monitoring for unusual gzip-encoded API traffic. In management APIs and other control planes, safe compression handling is part of basic hardening.