org.http4k:http4k-client-apache (2.3.0), org.http4k:http4k-client-okhttp (2.3.0) +8 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (2.3.0)

org.http4k:http4k-core MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 2.3.0 - org.http4k:http4k-client-okhttp 2.3.0 - org.http4k:http4k-contract 2.3.0 -...

org.http4k:http4k-aws (2.21.2), org.http4k:http4k-client-apache (2.21.2) +13 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (2.21.2)

org.http4k:http4k-core MAVEN version 2.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.21.2 - org.http4k:http4k-client-apache 2.21.2 - org.http4k:http4k-client-okhttp 2.21.2 -...

org.http4k:http4k-aws (2.23.0), org.http4k:http4k-client-apache (2.23.0) +13 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (2.23.0)

org.http4k:http4k-core MAVEN version 2.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.23.0 - org.http4k:http4k-client-apache 2.23.0 - org.http4k:http4k-client-okhttp 2.23.0 -...

org.http4k:http4k-aws (3.218.0), org.http4k:http4k-client-apache (3.218.0) +32 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.218.0)

org.http4k:http4k-core MAVEN version 3.218.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.218.0 - org.http4k:http4k-client-apache 3.218.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.35.2), org.http4k:http4k-client-apache (3.35.2) +25 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.35.2)

org.http4k:http4k-core MAVEN version 3.35.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.35.2 - org.http4k:http4k-client-apache 3.35.2 - org.http4k:http4k-client-apache-async 3.35...

org.http4k:http4k-aws (3.175.0), org.http4k:http4k-client-apache (3.175.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.175.0)

org.http4k:http4k-core MAVEN version 3.175.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.175.0 - org.http4k:http4k-client-apache 3.175.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.141.0), org.http4k:http4k-client-apache (3.141.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.141.0)

org.http4k:http4k-core MAVEN version 3.141.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.141.0 - org.http4k:http4k-client-apache 3.141.0 - org.http4k:http4k-client-apache-async...

PT-2026-99452

Name of the Vulnerable Software and Affected Versions http4k versions prior to 6.48.0.0 http4k version 5.42.0.0 http4k version 4.51.0.0 Description The BasicCookieStorage a client-side cookie store used by ClientFilters.Cookies fails to enforce RFC 6265 scoping rules regarding the cookie domain,...

PT-2026-99451

Name of the Vulnerable Software and Affected Versions http4k versions prior to 6.49.0.0 http4k version 5.42.0.0 http4k version 4.51.0.0 Description When dispatching to configured virtual hosts, the reverseProxy and reverseProxyRouting functions use substring matching on the Host header by default...

EUVD-2024-3444

Malicious code in bioql PyPI...

CVE-2024-55875

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

Kotlin HTTP4k XXE

The vulnerability of the Kotlin HTTP http4k application’s toolset is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a remote attacker to perform XXE attacks...

XML External Entity

org.http4k, http4k-format-xml is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of malicious XML content in requests, which could allow attackers to access sensitive local information, perform Server-side Request Forgery SSRF, or potentially execute...

org.http4k:http4k (4.3.4.1) potentially affected by CVE-2024-55875 via org.http4k:http4k-format-xml (4.3.4.1)

org.http4k:http4k-format-xml MAVEN version 4.3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-format-xml and may be impacted: - org.http4k:http4k 4.3.4.1 Source cves: CVE-2024-55875 Source advisory: OSV:GHSA-7MJ5-HJJJ-8RGW...

org.http4k:http4k (4.3.3.0) potentially affected by CVE-2024-55875 via org.http4k:http4k-format-xml (4.3.3.0)

org.http4k:http4k-format-xml MAVEN version 4.3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-format-xml and may be impacted: - org.http4k:http4k 4.3.3.0 Source cves: CVE-2024-55875 Source advisory: OSV:GHSA-7MJ5-HJJJ-8RGW...

org.http4k:http4k (4.3.4.0) potentially affected by CVE-2024-55875 via org.http4k:http4k-format-xml (4.3.4.0)

org.http4k:http4k-format-xml MAVEN version 4.3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-format-xml and may be impacted: - org.http4k:http4k 4.3.4.0 Source cves: CVE-2024-55875 Source advisory: OSV:GHSA-7MJ5-HJJJ-8RGW...

GHSA-7MJ5-HJJJ-8RGW http4k has a potential XXE (XML External Entity Injection) vulnerability

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. There is a potential XXEXML External Entity Injection vulnerability when http4k...

CVE-2024-55875

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

CVE-2024-55875 http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE XML External Entity Injection vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server,...

CVE-2024-55875

The CVE-2024-55875 entry concerns http4k (Kotlin HTTP toolkit) where the XML parsing path in http4k-format-xml uses DocumentBuilder without security hardening, enabling XXE (XML External Entity Injection) via malicious XML in requests. This can lead to disclosure of local sensitive data, SSRF, an...