Vulnerabilities in http4k
9 resultsCVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.6%CVE-2026-54148HIGHhttp4k: `DigestAuthProvider.verify` did not bind to request URIEPSS 0.6%CVE-2026-100724MEDIUMhttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyEPSS 0.3%CVE-2026-100834HIGHhttp4k before 6.48.0.0 Digest Authentication Replay Protection BypassEPSS 0.3%CVE-2026-120316HIGHhttp4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template ResolutionEPSS 0.3%CVE-2026-54147MEDIUMhttp4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIEPSS 0.3%CVE-2026-100725HIGHhttp4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorageEPSS 0.2%CVE-2026-120317HIGHhttp4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body IntegrityEPSS 0.1%