Skip to content
OpenAdvisories

Vendor

http4k

9 known vulnerabilities.

Products

http4k 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-54148

    http4k: `DigestAuthProvider.verify` did not bind to request URI

    http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An…

    http4k http4k org.http4k:http4k-security-digest Maven
  • High 7.5
    CVE-2026-53659

    http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

    http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenti…

    http4k http4k org.http4k:http4k-core Maven