org.http4k:http4k-aws (3.162.0), org.http4k:http4k-client-apache (3.162.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.162.0)

org.http4k:http4k-core MAVEN version 3.162.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.162.0 - org.http4k:http4k-client-apache 3.162.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.165.0), org.http4k:http4k-client-apache (3.165.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.165.0)

org.http4k:http4k-core MAVEN version 3.165.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.165.0 - org.http4k:http4k-client-apache 3.165.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.166.1), org.http4k:http4k-client-apache (3.166.1) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.166.1)

org.http4k:http4k-core MAVEN version 3.166.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.166.1 - org.http4k:http4k-client-apache 3.166.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-client-apache (3.169.0), org.http4k:http4k-client-apache-async (3.169.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.169.0)

org.http4k:http4k-core MAVEN version 3.169.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 3.169.0 - org.http4k:http4k-client-apache-async 3.169.0 -...

org.http4k:http4k-aws (3.172.0), org.http4k:http4k-client-apache (3.172.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.172.0)

org.http4k:http4k-core MAVEN version 3.172.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.172.0 - org.http4k:http4k-client-apache 3.172.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.179.0), org.http4k:http4k-client-apache (3.179.0) +30 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.179.0)

org.http4k:http4k-core MAVEN version 3.179.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.179.0 - org.http4k:http4k-client-apache 3.179.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.179.1), org.http4k:http4k-client-apache (3.179.1) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.179.1)

org.http4k:http4k-core MAVEN version 3.179.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.179.1 - org.http4k:http4k-client-apache 3.179.1 - org.http4k:http4k-client-apache-async...

PT-2026-76889

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

PT-2026-76891

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function ignores the configured algorithm parameter and inste...

PT-2026-76892

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function fails to compare the uri parameter within an...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the BasicCookieStorage process, which does not enforce proper scoping rules for cookies as specified in RFC 6265. An attacker can access or receive cookies intended for other domains or schemes by leveraging a...

org.http4k.pro:http4k-incubator-db (v6.3.0.0), org.http4k.pro:http4k-mcp-sdk (v6.3.0.0) +173 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (v6.3.0.0)

org.http4k:http4k-core MAVEN version v6.3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.3.0.0 - org.http4k.pro:http4k-mcp-sdk v6.3.0.0 -...

org.http4k.pro:http4k-incubator-db (v6.4.1.0), org.http4k.pro:http4k-mcp-sdk (v6.4.1.0) +173 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (v6.4.1.0)

org.http4k:http4k-core MAVEN version v6.4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.4.1.0 - org.http4k.pro:http4k-mcp-sdk v6.4.1.0 -...

org.http4k:http4k-format-argo (0.21.0), org.http4k:http4k-format-jackson (0.21.0) +2 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (0.21.0)

org.http4k:http4k-core MAVEN version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-format-argo 0.21.0 - org.http4k:http4k-format-jackson 0.21.0 - org.http4k:http4k-server-netty...

org.http4k:http4k-client-apache (0.22.0), org.http4k:http4k-contract (0.22.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (0.22.0)

org.http4k:http4k-core MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 0.22.0 - org.http4k:http4k-contract 0.22.0 - org.http4k:http4k-format-argo 0.22.0 ...

org.http4k:http4k-client-apache (1.0.0), org.http4k:http4k-contract (1.0.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.0.0)

org.http4k:http4k-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.0.0 - org.http4k:http4k-contract 1.0.0 - org.http4k:http4k-format-argo 1.0.0 -...

org.http4k:http4k-client-apache (1.1.0), org.http4k:http4k-contract (1.1.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.1.0)

org.http4k:http4k-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.1.0 - org.http4k:http4k-contract 1.1.0 - org.http4k:http4k-format-argo 1.1.0 -...

org.http4k:http4k-client-apache (1.2.0), org.http4k:http4k-contract (1.2.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.2.0)

org.http4k:http4k-core MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.2.0 - org.http4k:http4k-contract 1.2.0 - org.http4k:http4k-format-argo 1.2.0 -...

org.http4k:http4k-client-apache (1.4.0), org.http4k:http4k-contract (1.4.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.4.0)

org.http4k:http4k-core MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.4.0 - org.http4k:http4k-contract 1.4.0 - org.http4k:http4k-format-argo 1.4.0 -...

org.http4k:http4k-client-apache (1.5.0), org.http4k:http4k-contract (1.5.0) +6 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.5.0)

org.http4k:http4k-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.5.0 - org.http4k:http4k-contract 1.5.0 - org.http4k:http4k-format-argo 1.5.0 -...