[ Vendor · 3 CVEs ]
http4k
CVEs affecting http4k published in the last 30 days, plus any http4k CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100834 | 27 Sep 2026 | CVSS 5.9 | http4khttp4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier… | |
| CVE-2026-100724 | 27 Sep 2026 | CVSS 5.4 | http4khttp4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default… | |
| CVE-2026-100725 | 27 Sep 2026 | CVSS 6.5 | http4khttp4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by… |