Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: http4k Clear all filters
TI-2026-83683 CVE-2026-120317 · GHSA-65gw-vqgg-jvcf

Missing body integrity check in http4k Digest auth-int

Priority HIGH 69

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00122 Published 2026-11-02 Fixed in 6.60.0.0 CWE-345
TI-2026-83682 CVE-2026-120316 · GHSA-r83g-mhw3-hx4p

Path traversal in http4k ThymeleafTemplates lets attackers read files

Priority LOW 35

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewM…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00309 Published 2026-11-02 Fixed in 6.62.0.0-ee CWE-22
TI-2026-64972 CVE-2026-100834 · GHSA-r39r-ww5m-7mv9

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

Priority LOW 36

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0032 Published 2026-09-27 Fixed in 6.48.0.0, 5.42.0.0 +1 CWE-294
TI-2026-64881 CVE-2026-100725 · GHSA-jggj-q26h-3m3c

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

Priority LOW 36

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00239 Published 2026-09-27 Partial fix · 6.48.0.0, 5.42.0.0 +1 CWE-200
TI-2026-64880 CVE-2026-100724 · GHSA-9hc9-gcfq-xg98

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

Priority LOW 28

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to config…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00344 Published 2026-09-27 Partial fix · 6.49.0.0, 5.42.0.0 +1 CWE-444