Vulnerabilidades em http4k
9 resultadosAnálise Vexday
O http4k apresenta um baixo volume de vulnerabilidades registradas (1 CVE), sem indicadores de exploração ativa em campo. A única falha crítica identificada refere-se à exposição de informações (CWE-200), risco moderado e sem atividade recente que justifique mudanças imediatas nas prioridades de remediação.
CVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.6%CVE-2026-54148HIGHhttp4k: `DigestAuthProvider.verify` did not bind to request URIEPSS 0.6%CVE-2026-100724MEDIUMhttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyEPSS 0.3%CVE-2026-100834HIGHhttp4k before 6.48.0.0 Digest Authentication Replay Protection BypassEPSS 0.3%CVE-2026-120316HIGHhttp4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template ResolutionEPSS 0.3%CVE-2026-54147MEDIUMhttp4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIEPSS 0.3%CVE-2026-100725HIGHhttp4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorageEPSS 0.2%CVE-2026-120317HIGHhttp4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body IntegrityEPSS 0.1%