Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.http4k:http4k-core

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 2 high, 1 medium
Dependents
246
Registry
Maven Central

Advisories 3

  • http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

    Affected: from 6.0.0.0, fixed in 6.48.0.0; from 5.0.0.0, fixed in 5.42.0.0; fixed in 4.51.0.0.

  • CVE-2026-100724Medium 6.3

    http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

    Affected: from 6.0.0.0, fixed in 6.49.0.0; from 5.0.0.0, fixed in 5.42.0.0; fixed in 4.51.0.0.

  • http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

    Affected: from 6.0.0.0, fixed in 6.49.0.0; from 5.0.0.0, fixed in 5.42.0.0; through 4.48.2.0.