Http4k

7 CVEs in 1 Http4k product, including Http4k. Newest: CVE-2026-100834 (2026-09-27). Severity, EPSS and public exploits for each.

Http4k products with known CVEs

ProductCVEs
Http4k7
Http4k CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-100834Medium5.92026-09-27http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter…
CVE-2026-100725Medium6.52026-09-27http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilte…
CVE-2026-100724Medium5.42026-09-27http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in revers…
CVE-2026-54148High8.12026-09-18http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest doe…
CVE-2026-54147Medium6.52026-09-18http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ign…
CVE-2026-53659High7.52026-09-14http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the unde…
CVE-2024-55875Critical9.82024-12-12http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability…