http4k — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in http4k, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-120317	http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity CWE-345	5.9	Medium	2026-11-02
CVE-2026-120316	http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution CWE-22	5.9	Medium	2026-11-02
CVE-2026-100834	http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass CWE-294	5.9	Medium	2026-09-27
CVE-2026-100724	http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy CWE-444	5.4	Medium	2026-09-27
CVE-2026-100725	http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage CWE-200	6.5	Medium	2026-09-27
CVE-2026-54147	http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI CWE-327	6.5	Medium	2026-09-18
CVE-2026-54148	http4k: `DigestAuthProvider.verify` did not bind to request URI CWE-294	8.1	High	2026-09-18
CVE-2026-53659	http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS CWE-409	7.5	High	2026-09-14
CVE-2024-55875	http4k has a potential XXE (XML External Entity Injection) vulnerability CWE-200	9.8	Critical	2024-12-12

All 9 known CVE vulnerabilities affecting http4k with full Chinese analysis, references, and POCs where available.