http4k vulnerabilities
9 published CVEs name http4k among the affected products.
- 9Published CVEs9 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-120317
http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity
http4k · http4k
High8.2 - CVE-2026-120316
http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution
http4k · http4k
High8.2 - CVE-2026-100834
http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
http4k · http4k
High8.2 - CVE-2026-100725
http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
http4k · http4k
High8.3 - CVE-2026-100724
http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
http4k · http4k
Medium6.3 - CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
http4k · http4k
Medium6.5 - CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
http4k · http4k
High8.1 - CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
http4k · http4k
High7.5 - CVE-2024-55875
http4k has a potential XXE (XML External Entity Injection) vulnerability
http4k · http4k
Critical9.8