CVE Tools
Track your stack

HTTP4K

2 CVEs tracked since 2026. Since Nov 2026, none of them reached CISA KEV.

HTTP4K CVEs per month

Nov 2026 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
HTTP4K CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-1120

Products

The products that kept showing up in HTTP4K's monthly top three, with their CVEs summed over those months.

  1. HTTP4K21 month

Latest CVEs

The 9 most recently published vulnerabilities affecting HTTP4K.

  1. CVE-2026-120317http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity5.9
  2. CVE-2026-120316http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution5.9
  3. CVE-2026-100834http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass5.9
  4. CVE-2026-100725http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage6.5
  5. CVE-2026-100724http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy5.4
  6. CVE-2026-54147http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI6.5
  7. CVE-2026-54148http4k: `DigestAuthProvider.verify` did not bind to request URI8.1
  8. CVE-2026-53659http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS7.5
  9. CVE-2024-55875http4k has a potential XXE (XML External Entity Injection) vulnerability9.8

The record

Peak rank
#12 in Nov 2026
Busiest month shown
Nov 2026, 2 CVEs
Months with a KEV entry
0 since Nov 2026
Monthly snapshots
1 since 2026
HTTP4K's full record, month by month