org.http4k:http4k-aws (2.18.1), org.http4k:http4k-client-apache (2.18.1) +13 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.18.1)

org.http4k:http4k-core MAVEN version 2.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.18.1 - org.http4k:http4k-client-apache 2.18.1 - org.http4k:http4k-client-okhttp 2.18.1 -...

org.http4k:http4k-aws (3.189.0), org.http4k:http4k-client-apache (3.189.0) +31 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.189.0)

org.http4k:http4k-core MAVEN version 3.189.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.189.0 - org.http4k:http4k-client-apache 3.189.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.16.0), org.http4k:http4k-client-apache (3.16.0) +23 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.16.0)

org.http4k:http4k-core MAVEN version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.16.0 - org.http4k:http4k-client-apache 3.16.0 - org.http4k:http4k-client-apache-async 3.16...

org.http4k:http4k-aws (3.258.0), org.http4k:http4k-client-apache (3.258.0) +44 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.258.0)

org.http4k:http4k-core MAVEN version 3.258.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.258.0 - org.http4k:http4k-client-apache 3.258.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.246.0), org.http4k:http4k-client-apache (3.246.0) +34 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.246.0)

org.http4k:http4k-core MAVEN version 3.246.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.246.0 - org.http4k:http4k-client-apache 3.246.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-client-apache (3.169.0), org.http4k:http4k-client-apache-async (3.169.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.169.0)

org.http4k:http4k-core MAVEN version 3.169.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 3.169.0 - org.http4k:http4k-client-apache-async 3.169.0 -...

org.http4k:http4k-aws (3.199.0), org.http4k:http4k-client-apache (3.199.0) +32 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.199.0)

org.http4k:http4k-core MAVEN version 3.199.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.199.0 - org.http4k:http4k-client-apache 3.199.0 - org.http4k:http4k-client-apache-async...

PT-2026-76889

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

PT-2026-76891

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function ignores the configured algorithm parameter and inste...

PT-2026-76892

Name of the Vulnerable Software and Affected Versions http4k versions prior to 4.51.0.0 http4k versions prior to 5.42.0.0 http4k versions prior to 6.50.0.0 Description In the http4k-security-digest module, the DigestAuthProvider.verify function fails to compare the uri parameter within an...

org.http4k:http4k-aws (2.10.1), org.http4k:http4k-client-apache (2.10.1) +11 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.10.1)

org.http4k:http4k-core MAVEN version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.10.1 - org.http4k:http4k-client-apache 2.10.1 - org.http4k:http4k-client-okhttp 2.10.1 -...

org.http4k:http4k-aws (2.11.2), org.http4k:http4k-client-apache (2.11.2) +11 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.11.2)

org.http4k:http4k-core MAVEN version 2.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.11.2 - org.http4k:http4k-client-apache 2.11.2 - org.http4k:http4k-client-okhttp 2.11.2 -...

org.http4k:http4k-aws (2.29.3), org.http4k:http4k-client-apache (2.29.3) +15 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.29.3)

org.http4k:http4k-core MAVEN version 2.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.29.3 - org.http4k:http4k-client-apache 2.29.3 - org.http4k:http4k-client-okhttp 2.29.3 -...

org.http4k:http4k-aws (3.143.1), org.http4k:http4k-client-apache (3.143.1) +31 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.143.1)

org.http4k:http4k-core MAVEN version 3.143.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.143.1 - org.http4k:http4k-client-apache 3.143.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.112.1), org.http4k:http4k-client-apache (3.112.1) +28 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.112.1)

org.http4k:http4k-core MAVEN version 3.112.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.112.1 - org.http4k:http4k-client-apache 3.112.1 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-client-apache (2.5.1), org.http4k:http4k-client-okhttp (2.5.1) +8 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.5.1)

org.http4k:http4k-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 2.5.1 - org.http4k:http4k-client-okhttp 2.5.1 - org.http4k:http4k-contract 2.5.1 -...

org.http4k:http4k-aws (2.18.3), org.http4k:http4k-client-apache (2.18.3) +13 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (2.18.3)

org.http4k:http4k-core MAVEN version 2.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.18.3 - org.http4k:http4k-client-apache 2.18.3 - org.http4k:http4k-client-okhttp 2.18.3 -...

org.http4k:http4k-client-apache (1.25.0), org.http4k:http4k-client-okhttp (1.25.0) +8 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.25.0)

org.http4k:http4k-core MAVEN version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.25.0 - org.http4k:http4k-client-okhttp 1.25.0 - org.http4k:http4k-contract 1.25....

org.http4k:http4k-client-okhttp (1.22.0), org.http4k:http4k-format-argo (1.22.0) +4 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (1.22.0)

org.http4k:http4k-core MAVEN version 1.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-okhttp 1.22.0 - org.http4k:http4k-format-argo 1.22.0 - org.http4k:http4k-format-gson 1.22...

org.http4k:http4k-aws (3.153.0), org.http4k:http4k-client-apache (3.153.0) +31 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.153.0)

org.http4k:http4k-core MAVEN version 3.153.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.153.0 - org.http4k:http4k-client-apache 3.153.0 - org.http4k:http4k-client-apache-async...