Http4k - vulnerabilities (CVEs)

7 CVEs in 1 products, 0 in the last 30 days, newest from 2026-09-27.

Products

CVE-2026-100834 - CVSS 8.2 (high), 2026-09-27: http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter…
CVE-2026-100725 - CVSS 8.3 (high), 2026-09-27: http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by…
CVE-2026-100724 - CVSS 6.3 (medium), 2026-09-27: http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in…
CVE-2026-54147 - CVSS 6.5 (medium), 2026-09-18: http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest…
CVE-2026-54148 - CVSS 8.1 (high), 2026-09-18: http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest…
CVE-2026-53659 - CVSS 7.5 (high), 2026-09-14: http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the…
CVE-2024-55875 - CVSS 9.8 (critical), 2024-12-12: http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability…