CVE-2026-100725

A flaw was found in http4k-core. The client-side cookie storage mechanism fails to enforce standard scoping rules for domain, path, and secure transmission attributes. When an application communicates with multiple destinations using a single cookie store, cookies intended for one server can be...

com.apollographql.execution:apollo-execution-http4k (0.1.2), com.apollographql.execution:apollo-execution-http4k-jvm (0.1.2) +356 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (>=6.0.0.0, <=6.48.0.0)

org.http4k:http4k-core MAVEN version =6.0.0.0, =0.6.0, =0.1.1, =0.1.1, =0.1.1, =2.1.2-beta1, =4.0.0-rc27, =2.1.2-beta1, =2.1.2-beta1, =4.0.0-rc27, =2.1.2-beta1, =2.1.2-beta1, =5.3.1 and more Source cves: CVE-2026-53659 Source advisory: MEND:CVE-2026-53659...

com.apollographql.execution:apollo-execution-http4k (>=0.0.2, <=0.1.1), com.apollographql.execution:apollo-execution-http4k-jvm (>=0.0.2, <=0.1.1) +333 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (>=5.0.0.0, <=5.41.0.0)

org.http4k:http4k-core MAVEN version =5.0.0.0, =0.0.2, =0.0.2, =0.0.1, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =0.5.0, =1.30.0, =0.1, =0.1.1 and more Source cves: CVE-2026-53659 Source advisory: MEND:CVE-2026-53659...

org.http4k:http4k-aws (2.25.2), org.http4k:http4k-client-apache (2.25.2) +5 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.25.2)

org.http4k:http4k-core MAVEN version 2.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.25.2 - org.http4k:http4k-client-apache 2.25.2 - org.http4k:http4k-client-okhttp 2.25.2 -...

org.http4k:http4k-aws (2.31.3), org.http4k:http4k-client-apache (2.31.3) +16 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.31.3)

org.http4k:http4k-core MAVEN version 2.31.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.31.3 - org.http4k:http4k-client-apache 2.31.3 - org.http4k:http4k-client-okhttp 2.31.3 -...

org.http4k:http4k-client-apache (1.24.0), org.http4k:http4k-client-okhttp (1.24.0) +8 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.24.0)

org.http4k:http4k-core MAVEN version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.24.0 - org.http4k:http4k-client-okhttp 1.24.0 - org.http4k:http4k-contract 1.24....

org.http4k:http4k-client-apache (2.3.0), org.http4k:http4k-client-okhttp (2.3.0) +8 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.3.0)

org.http4k:http4k-core MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 2.3.0 - org.http4k:http4k-client-okhttp 2.3.0 - org.http4k:http4k-contract 2.3.0 -...

org.http4k:http4k-aws (3.126.0), org.http4k:http4k-client-apache (3.126.0) +30 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.126.0)

org.http4k:http4k-core MAVEN version 3.126.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.126.0 - org.http4k:http4k-client-apache 3.126.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-client-apache (1.23.0), org.http4k:http4k-client-okhttp (1.23.0) +8 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.23.0)

org.http4k:http4k-core MAVEN version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.23.0 - org.http4k:http4k-client-okhttp 1.23.0 - org.http4k:http4k-contract 1.23....

org.http4k:http4k-aws (3.157.1), org.http4k:http4k-client-apache (3.157.1) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.157.1)

org.http4k:http4k-core MAVEN version 3.157.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.157.1 - org.http4k:http4k-client-apache 3.157.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.173.0), org.http4k:http4k-client-apache (3.173.0) +24 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.173.0)

org.http4k:http4k-core MAVEN version 3.173.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.173.0 - org.http4k:http4k-client-apache 3.173.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.259.0), org.http4k:http4k-client-apache (3.259.0) +44 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.259.0)

org.http4k:http4k-core MAVEN version 3.259.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.259.0 - org.http4k:http4k-client-apache 3.259.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (2.29.4), org.http4k:http4k-client-apache (2.29.4) +15 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.29.4)

org.http4k:http4k-core MAVEN version 2.29.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.29.4 - org.http4k:http4k-client-apache 2.29.4 - org.http4k:http4k-client-okhttp 2.29.4 -...

org.http4k:http4k-aws (3.195.1), org.http4k:http4k-client-apache (3.195.1) +32 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.195.1)

org.http4k:http4k-core MAVEN version 3.195.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.195.1 - org.http4k:http4k-client-apache 3.195.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.238.0), org.http4k:http4k-client-apache (3.238.0) +34 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.238.0)

org.http4k:http4k-core MAVEN version 3.238.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.238.0 - org.http4k:http4k-client-apache 3.238.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.32.0), org.http4k:http4k-client-apache (3.32.0) +25 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.32.0)

org.http4k:http4k-core MAVEN version 3.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.32.0 - org.http4k:http4k-client-apache 3.32.0 - org.http4k:http4k-client-apache-async 3.32...

org.http4k:http4k-aws (2.23.0), org.http4k:http4k-client-apache (2.23.0) +13 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.23.0)

org.http4k:http4k-core MAVEN version 2.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.23.0 - org.http4k:http4k-client-apache 2.23.0 - org.http4k:http4k-client-okhttp 2.23.0 -...

org.http4k:http4k-aws (2.9.0), org.http4k:http4k-client-apache (2.9.0) +11 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.9.0)

org.http4k:http4k-core MAVEN version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.9.0 - org.http4k:http4k-client-apache 2.9.0 - org.http4k:http4k-client-okhttp 2.9.0 -...

org.http4k:http4k-client-apache (2.0.0), org.http4k:http4k-client-okhttp (2.0.0) +8 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.0.0)

org.http4k:http4k-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 2.0.0 - org.http4k:http4k-client-okhttp 2.0.0 - org.http4k:http4k-contract 2.0.0 -...

org.http4k:http4k-aws (3.2.1), org.http4k:http4k-client-apache (3.2.1) +17 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.2.1)

org.http4k:http4k-core MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.2.1 - org.http4k:http4k-client-apache 3.2.1 - org.http4k:http4k-client-okhttp 3.2.1 -...