HT
Vendor
http4k
7
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100834 | HT http4k http4k | 5.9 | Sep 27 | http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass |
| CVE-2026-100725 | HT http4k http4k | 6.5 | Sep 27 | http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage |
| CVE-2026-100724 | HT http4k http4k | 5.4 | Sep 27 | http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy |
| CVE-2026-54147 | HT http4k http4k | 6.5 | Sep 18 | http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI |
| CVE-2026-54148 | HT http4k http4k | 8.1 | Sep 18 | http4k: `DigestAuthProvider.verify` did not bind to request URI |
| CVE-2026-53659 | HT http4k http4k | 7.5 | Sep 14 | http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS |
| CVE-2024-55875 | HT http4k http4k | 9.8 | Dec 12 | http4k has a potential XXE (XML External Entity Injection) vulnerability |