http4k has 7 CVEs on record. Cadence is steady at roughly 3 per quarter. The busiest recent month was June 2026 with 4. The median CVSS is 7.5 (high). None have a confirmed exploitation report. Most affected products: http4k (3), org.http4k:http4k-core (3), org.http4k:http4k-security-digest (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 4
Products
- http4k 3
- org.http4k:http4k-core 3
- org.http4k:http4k-security-digest 1
Worst active — by depth score
CVE-2026-54148High· 8.1http4k is a functional toolkit for Kotlin HTTP applications45CVE-2026-53659High· 7.5http4k is a functional toolkit for Kotlin HTTP applications41GHSA-m4w9-hjfw-vwj4Highhttp4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`41CVE-2026-54147Medium· 6.5http4k is a functional toolkit for Kotlin HTTP applications36GHSA-pr33-38xx-6r26Mediumhttp4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default28
http4k vulnerabilities
CVEs affecting http4k, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-54147Medium· 6.5http4k is a functional toolkit for Kotlin HTTP applications
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response wit…
CVE-2026-54148High· 8.1http4k is a functional toolkit for Kotlin HTTP applications
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the …
CVE-2026-53659High· 7.5http4k is a functional toolkit for Kotlin HTTP applications
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompress…
GHSA-jrpc-7vxp-69p6Mediumhttp4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
GHSA-m4w9-hjfw-vwj4Highhttp4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
GHSA-pr33-38xx-6r26Mediumhttp4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
GHSA-c7jm-38gq-h67hMediumhttp4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments