org.http4k:http4k-aws (3.94.0), org.http4k:http4k-client-apache (3.94.0) +26 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.94.0)

org.http4k:http4k-core MAVEN version 3.94.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.94.0 - org.http4k:http4k-client-apache 3.94.0 - org.http4k:http4k-client-apache-async 3.94...

org.http4k:http4k-aws (3.39.1), org.http4k:http4k-client-apache (3.39.1) +26 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.39.1)

org.http4k:http4k-core MAVEN version 3.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.39.1 - org.http4k:http4k-client-apache 3.39.1 - org.http4k:http4k-client-apache-async 3.39...

org.http4k:http4k-aws (3.241.0), org.http4k:http4k-client-apache (3.241.0) +34 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.241.0)

org.http4k:http4k-core MAVEN version 3.241.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.241.0 - org.http4k:http4k-client-apache 3.241.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.134.0), org.http4k:http4k-client-apache (3.134.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.134.0)

org.http4k:http4k-core MAVEN version 3.134.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.134.0 - org.http4k:http4k-client-apache 3.134.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.225.0), org.http4k:http4k-client-apache (3.225.0) +22 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.225.0)

org.http4k:http4k-core MAVEN version 3.225.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.225.0 - org.http4k:http4k-client-apache 3.225.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.22.3), org.http4k:http4k-client-apache (3.22.3) +10 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.22.3)

org.http4k:http4k-core MAVEN version 3.22.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.22.3 - org.http4k:http4k-client-apache 3.22.3 - org.http4k:http4k-client-apache-async 3.22...

org.http4k:http4k-aws (3.248.0), org.http4k:http4k-client-apache (3.248.0) +38 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.248.0)

org.http4k:http4k-core MAVEN version 3.248.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.248.0 - org.http4k:http4k-client-apache 3.248.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.242.0), org.http4k:http4k-client-apache (3.242.0) +34 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.242.0)

org.http4k:http4k-core MAVEN version 3.242.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.242.0 - org.http4k:http4k-client-apache 3.242.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.223.0), org.http4k:http4k-client-apache (3.223.0) +32 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.223.0)

org.http4k:http4k-core MAVEN version 3.223.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.223.0 - org.http4k:http4k-client-apache 3.223.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.18.0), org.http4k:http4k-client-apache (3.18.0) +23 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.18.0)

org.http4k:http4k-core MAVEN version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.18.0 - org.http4k:http4k-client-apache 3.18.0 - org.http4k:http4k-client-apache-async 3.18...

org.http4k:http4k-aws (3.183.0), org.http4k:http4k-client-apache (3.183.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.183.0)

org.http4k:http4k-core MAVEN version 3.183.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.183.0 - org.http4k:http4k-client-apache 3.183.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.26.1), org.http4k:http4k-client-apache (3.26.1) +25 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.26.1)

org.http4k:http4k-core MAVEN version 3.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.26.1 - org.http4k:http4k-client-apache 3.26.1 - org.http4k:http4k-client-apache-async 3.26...

org.http4k:http4k-aws (3.35.2), org.http4k:http4k-client-apache (3.35.2) +25 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.35.2)

org.http4k:http4k-core MAVEN version 3.35.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.35.2 - org.http4k:http4k-client-apache 3.35.2 - org.http4k:http4k-client-apache-async 3.35...

org.http4k:http4k-aws (3.175.0), org.http4k:http4k-client-apache (3.175.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.175.0)

org.http4k:http4k-core MAVEN version 3.175.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.175.0 - org.http4k:http4k-client-apache 3.175.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.141.0), org.http4k:http4k-client-apache (3.141.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.141.0)

org.http4k:http4k-core MAVEN version 3.141.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.141.0 - org.http4k:http4k-client-apache 3.141.0 - org.http4k:http4k-client-apache-async...

undici WebSocket client vulnerable to denial of service via fragment count bypass

Impact The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size...

NPM: undici WebSocket client vulnerable to denial of service via fragment count bypass

NPM: undici WebSocket client vulnerable to denial of service via fragment count bypass vulnerability discovered by ? in WordPress Npm undici versions 6.27.0...

EUVD-2026-37747

undici WebSocket client vulnerable to denial of service via fragment count bypass...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the WebsocketToken handler and the WebSocket upgrader process. An attacker can access sensitive session state and resource information by obtaining a CSRF token from an unauthenticated...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the WebsocketToken handler and the WebSocket upgrader process. An attacker can access sensitive session state and resource information by obtaining a CSRF token from an unauthenticated...