Mitigate the CRIME TLS compression attack on web servers

What's happening

CRIME (Compression Ratio Info-leak Made Easy, CVE-2012-4929) recovers TLS session cookies by observing how the size of compressed records changes when the attacker injects guessed bytes into the request. If the guessed byte matches a real cookie byte, the compressed record is one byte shorter; otherwise it is one byte longer. The attacker iterates through the cookie one byte at a time.

The original CRIME attack required TLS-level compression, which OpenSSL has disabled by default since 2012 and which is irrelevant for TLS 1.3 (which has no compression). Modern web servers no longer ship TLS compression. The related BREACH attack (CVE-2013-3587) targets HTTP-level compression of secrets in response bodies, and it remains exploitable when an application gzip's a response that contains both attacker-influenced input and a session secret.

The fix is to confirm TLS compression is disabled (it almost certainly already is) and to address BREACH-style HTTP-compression risk by separating user-influenced input from secrets and by using compression sparingly on authenticated responses.

Why it matters

Session cookie recovery means full account takeover. The attacker who can run JavaScript on a victim's network or in an iframe can issue thousands of crafted requests and exfiltrate the cookie within minutes.

PCI-DSS and OWASP both require CRIME mitigation. Scanners flag any server that advertises Compression: Yes in its TLS handshake.

BREACH on dynamic, authenticated pages with reflected user input is a real ongoing risk in 2026 — particularly for search results pages and account dashboards that compress responses.

Common causes

• OpenSSL build older than 1.0.0 with TLS compression compiled in.
• SPDY (HTTP/2 predecessor) was enabled with header compression that exposed similar leaks.
• Application gzip compresses responses that contain CSRF tokens, session IDs, or secrets alongside reflected user input.
• A reverse proxy enables compression unconditionally on every response.
• Custom code uses zlib in an attacker-controlled context.

Detect this on your site

Run a quick scan with the SSL Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Check whether TLS compression is offered

   Run openssl s_client -connect example.com:443 -servername example.com /dev/null | grep -i compression. The output should read 'Compression: NONE' or 'No compression'. If it lists DEFLATE or anything else, TLS compression is on and CRIME applies.

2. 2

   Disable TLS compression in nginx

   OpenSSL 1.0.0+ disables compression by default. If your build still has it, recompile OpenSSL with OPENSSL_NO_COMP or upgrade. Most modern OS packages already do this. nginx itself has no separate TLS compression toggle.

3. 3

   Disable TLS compression in Apache

   Apache 2.4.4+ disables compression by default; older versions can be patched or rebuilt. The relevant build flag is --disable-comp. Check httpd -V | grep -i comp for visibility.

4. 4

   Address BREACH risk in application responses

   Do not gzip responses that mix reflected user input with secrets. Separate authenticated responses from user-controlled query parameters where possible. Use random per-request padding (CSRF tokens included as masked values) on response bodies that must be compressed.

5. 5

   Restrict compression to safe content types

   Configure your reverse proxy to compress only static assets (CSS, JS, fonts) and avoid compressing HTML responses on authenticated routes. In nginx: tighten gzip_types and consider gzip off on dynamic authenticated locations.

6. 6

   Verify with a TLS scanner

   Re-run the openssl command and the SSL Labs test. The TLS compression line must read Off. Run a BREACH-style probe (badssl.com hosts proof-of-concept tools) on authenticated pages that gzip their responses.

Example

# Confirm TLS compression is off on the wire
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | grep -i compression
# Expected: Compression: NONE

Verify TLS compression is disabled

Related fixes