Vulnerability	Vulnerable Version
M HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling in the `reverseProxy` process. An attacker can bypass routing-based authorization by sending a specially crafted `Host` header that matches a configured virtual host via substring, allowing unauthorized access to restricted routes. This is only exploitable if the deployment uses `reverseProxy()` or `reverseProxyRouting()` as a public-facing inbound HTTP handler with two or more configured virtual hosts. How to fix HTTP Request Smuggling? Upgrade `org.http4k:http4k-core` to version 4.51.0.0, 5.42.0.0, 6.49.0.0 or higher.	[,4.51.0.0)[5.0.0.0,5.42.0.0)[6.0.0.0,6.49.0.0)
H Insufficient Verification of Data Authenticity Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through the misleadingly named `HmacSha256.hash` function. An attacker can bypass message authentication by exploiting the use of an unkeyed digest where a keyed HMAC was expected. This is only exploitable if downstream callers incorrectly assume `HmacSha256.hash` provides keyed authentication and use it for message authentication purposes. How to fix Insufficient Verification of Data Authenticity? Upgrade `org.http4k:http4k-core` to version 6.49.0.0 or higher.	[,6.49.0.0)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling in the reverseProxy process. An attacker can bypass routing-based authorization by sending a specially crafted Host header that matches a configured virtual host via substring, allowing unauthorized access to restricted routes. This is only exploitable if the deployment uses reverseProxy() or reverseProxyRouting() as a public-facing inbound HTTP handler with two or more configured virtual hosts.

How to fix HTTP Request Smuggling?

Upgrade org.http4k:http4k-core to version 4.51.0.0, 5.42.0.0, 6.49.0.0 or higher.

[,4.51.0.0)[5.0.0.0,5.42.0.0)[6.0.0.0,6.49.0.0)

Insufficient Verification of Data Authenticity

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through the misleadingly named HmacSha256.hash function. An attacker can bypass message authentication by exploiting the use of an unkeyed digest where a keyed HMAC was expected. This is only exploitable if downstream callers incorrectly assume HmacSha256.hash provides keyed authentication and use it for message authentication purposes.

How to fix Insufficient Verification of Data Authenticity?

Upgrade org.http4k:http4k-core to version 6.49.0.0 or higher.

[,6.49.0.0)

Go back to all versions of this package