Every advisory below ships with the full story - root cause, affected versions, fix, and a timestamped timeline from discovery to disclosure. No quiet patches, no buried CVEs.
Disclose privately via GitHub Security Advisories or [email protected]. We respond fast - see the timelines below.
How we triage, fix and disclose vulnerabilities responsibly. Read the full policy.
Public cosign keys for verifying http4k artifact signatures and provenance.
GHSA-9xx4-xjpj-xqcf: Digest auth-int QoP omitted entity-body integrity
The Digest auth-int digest was computed without hashing the request body, so an on-path attacker could tamper with the body of an authenticated …
GHSA-wq4x-r858-gmmj: Thymeleaf template path traversal
A ViewModel template name containing ../ segments could escape baseTemplateDir in ThymeleafTemplates, letting a client read arbitrary files the server …
CVE-2026-53659: Unbounded gzip decompression allowed memory-exhaustion DoS
A small malicious gzip-encoded request body could decompress to gigabytes, exhausting the JVM heap and denying service to other clients.
CVE-2026-54147: DigestAuthProvider.verify ignored configured algorithm
The configured `algorithm` parameter was silently ignored; every verification used MD5 regardless of configuration, exposing deployments to MD5's …
CVE-2026-54148: DigestAuthProvider.verify did not bind to request URI
A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the …
GHSA-c7jm-38gq-h67h: DigestAuth defaulted to an always-true nonce verifier
ServerFilters.DigestAuth and DigestAuthProvider accepted every nonce by default, so default deployments had no replay protection on Digest …
GHSA-jrpc-7vxp-69p6: reverseProxy() defaulted to substring Host matching
reverseProxy() matched virtual hosts by substring on the Host header by default, so a public-facing deployment could route Host admin.evil.com to a …
GHSA-m4w9-hjfw-vwj4: HmacSha256.hash computed a plain unkeyed digest
Despite its Hmac naming, HmacSha256.hash computed a plain unkeyed SHA-256 digest. It is deprecated in favour of the explicit Sha256.hash and …
GHSA-pr33-38xx-6r26: BasicCookieStorage did not enforce RFC 6265 cookie scoping
BasicCookieStorage ignored cookie domain, path and Secure scoping, so a client talking to multiple origins could leak cookies across domains or send …
CVE-2024-55875: XXE(XML External Entity Injection) vulnerability
XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents
We run proactive, LLM-assisted security audits across the entire http4k codebase - putting frontier models in the ring against all 200+ modules to surface issues before anyone in the wild does. Several of the advisories above came straight out of that programme, including bugs quietly present since 2017. Software that claims zero vulnerabilities usually just isn't looking.
Read "Tale of the tape: Claude vs http4k" →