org.http4k:http4k-core
Maven3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.http4k:http4k-corepage 1 of 1
- CVE-2026-100724MEDIUMCVSS 5.4EG 5.4fixed in 6.49.0.0, 5.42.0.0 or 4.51.0.0, by version range2026-09-27
vulnerable: 0.21.0 ... v6.4.1.0 (607 versions)
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts.…
- CVE-2026-100725MEDIUMCVSS 6.5EG 6.5fixed in 6.48.0.0, 5.42.0.0 or 4.51.0.0, by version range2026-09-27
vulnerable: 0.21.0 ... v6.4.1.0 (607 versions)
http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, …
- CVE-2026-53659HIGHCVSS 7.5EG 7.5fixed in 6.49.0.0 or 5.42.0.0, by version range2026-08-17
vulnerable: 0.21.0 ... v6.4.1.0 (607 versions)
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed…
Check whether org.http4k:http4k-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.http4k:http4k-core CVEs against the assets you own.
Book a Demo →