Http4k vulnerabilities
We track 3 vulnerabilities in Http4k products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Http4k vulnerabilities
- 8.1 High severity
http4k: Authentication Bypass by Capture-replay
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An
- 7.5 High severity
http4k: Improper Handling of Highly Compressed Data (Data Amplification)
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthentic
- 9.8 Critical severity
http4k: Exposure of Sensitive Information to an Unauthorized Actor
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read loca