Read the docs

http4k

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

http4k records in CISA KEV

No http4k vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-83683 CVE-2026-120317 · GHSA-65gw-vqgg-jvcf

Missing body integrity check in http4k Digest auth-int

Priority HIGH 69

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00122 Published 2026-11-02 Fixed in 6.60.0.0 CWE-345
TI-2026-64972 CVE-2026-100834 · GHSA-r39r-ww5m-7mv9

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

Priority LOW 36

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0032 Published 2026-09-27 Fixed in 6.48.0.0, 5.42.0.0 +1 CWE-294
TI-2026-64881 CVE-2026-100725 · GHSA-jggj-q26h-3m3c

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

Priority LOW 36

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00239 Published 2026-09-27 Partial fix · 6.48.0.0, 5.42.0.0 +1 CWE-200
TI-2026-83682 CVE-2026-120316 · GHSA-r83g-mhw3-hx4p

Path traversal in http4k ThymeleafTemplates lets attackers read files

Priority LOW 35

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewM…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00309 Published 2026-11-02 Fixed in 6.62.0.0-ee CWE-22
TI-2026-64880 CVE-2026-100724 · GHSA-9hc9-gcfq-xg98

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

Priority LOW 28

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to config…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00344 Published 2026-09-27 Partial fix · 6.49.0.0, 5.42.0.0 +1 CWE-444
Open these records in search →