Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: http4k, http4k 4.51.0.0, 5.42.0.0 Clear all filters
TI-2026-64972 CVE-2026-100834 · GHSA-r39r-ww5m-7mv9

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

Priority LOW 36

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0032 Published 2026-09-27 Fixed in 6.48.0.0, 5.42.0.0 +1 CWE-294
TI-2026-64881 CVE-2026-100725 · GHSA-jggj-q26h-3m3c

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

Priority LOW 36

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00239 Published 2026-09-27 Partial fix · 6.48.0.0, 5.42.0.0 +1 CWE-200
TI-2026-64880 CVE-2026-100724 · GHSA-9hc9-gcfq-xg98

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

Priority LOW 28

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to config…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00344 Published 2026-09-27 Partial fix · 6.49.0.0, 5.42.0.0 +1 CWE-444