Hhttp4k

Products

Exploited and recent CVEs

• CVE-2026-120317 Medium 5.9 http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity 0.1%
• CVE-2026-120316 Medium 5.9 http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution 0.3%
• CVE-2026-100834 Medium 5.9 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass 0.3%
• CVE-2026-100725 Medium 6.5 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage 0.2%
• CVE-2026-100724 Medium 5.4 http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy 0.3%
• CVE-2026-54147 Medium 6.5 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI 0.3%
• CVE-2026-54148 High 8.1 http4k: `DigestAuthProvider.verify` did not bind to request URI 0.6%
• CVE-2026-53659 High 7.5 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS 0.6%
• CVE-2024-55875 Critical 9.8 http4k has a potential XXE (XML External Entity Injection) vulnerability 1.9%