Skip to content
OpenAdvisories

Package · Maven

org.http4k:http4k-core

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-100725

    http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

    http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure att…

    http4k http4k org.http4k:http4k-core Maven
  • Medium 5.4
    CVE-2026-100724

    http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

    http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions …

    http4k http4k org.http4k:http4k-core Maven