HTTP: Invalid GZIP Transaction
This anomaly is triggered if a mismatch is detected between the indicated value "gzip" in the Content-encoding header and the actual data. The type of payload should start from the pattern "1f 8b" and if it doesn't, it may be an attempt by malware to obfuscate the payload and it will be detected by this anomaly.
References
CVE: CVE-2004-0797
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
2.1