Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: http4k 6.48.0.0 Clear all filters
TI-2026-64972 CVE-2026-100834 · GHSA-r39r-ww5m-7mv9

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

Priority LOW 36

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0032 Published 2026-09-27 Fixed in 6.48.0.0, 5.42.0.0 +1 CWE-294
TI-2026-64881 CVE-2026-100725 · GHSA-jggj-q26h-3m3c

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

Priority LOW 36

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00239 Published 2026-09-27 Partial fix · 6.48.0.0, 5.42.0.0 +1 CWE-200