org.http4k:http4k-core vulnerabilities
CVEs whose affected-version data names the org.http4k:http4k-core package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
GHSA-jrpc-7vxp-69p6Mediumhttp4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
▾ Sunlithttp4k · org.http4k:http4k-corevia GHSA
GHSA-m4w9-hjfw-vwj4Highhttp4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
▾ Twilighthttp4k · org.http4k:http4k-corevia GHSA
GHSA-pr33-38xx-6r26Mediumhttp4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
▾ Sunlithttp4k · org.http4k:http4k-corevia GHSA