Login Request a demo
HT
Product
http4k
by http4k · last CVE Sep 27, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 1High 2Medium 4Low 0
Severity
All severities7Critical1High2Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add http4k to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-55875
9.8
2%
Dec 12
http4k has a potential XXE (XML External Entity Injection) vulnerability
Affected: < 6.50.0.0
CVE-2026-54148
8.1
1%
Sep 18
http4k: `DigestAuthProvider.verify` did not bind to request URI
Affected: < 4.51.0.0; >= 5.0.0.0, < 5.42.0.0; >= 6.0.0.0, < 6.50.0.0
CVE-2026-53659
7.5
1%
Sep 14
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Affected: < 4.51.0.0; >= 5.0.0.0, < 5.42.0.0; >= 6.0.0.0, < 6.49.0.0
CVE-2026-100725
6.5
0%
Sep 27
http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
Affected: before 6.48.0.0; before 5.42.0.0; before 4.51.0.0
CVE-2026-54147
6.5
0%
Sep 18
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Affected: < 4.51.0.0; >= 5.0.0.0, < 5.42.0.0; >= 6.0.0.0, < 6.50.0.0
CVE-2026-100834
5.9
0%
Sep 27
http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
Affected: before 6.48.0.0; before 5.42.0.0; before 4.51.0.0
CVE-2026-100724
5.4
0%
Sep 27
http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
Affected: before 6.49.0.0; before 5.42.0.0; before 4.51.0.0
Showing 7