HTTP Request Smuggling Affecting org.http4k:http4k-core package, versions [,4.51.0.0)[5.0.0.0,5.42.0.0)[6.0.0.0,6.49.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGHTTP4K-17732797
- published30 Jun 2026
- disclosed19 Jun 2026
- creditUnknown
Introduced: 19 Jun 2026
CVE NOT AVAILABLE CWE-444 (opens in a new tab)How to fix?
Upgrade org.http4k:http4k-core to version 4.51.0.0, 5.42.0.0, 6.49.0.0 or higher.
Overview
Affected versions of this package are vulnerable to HTTP Request Smuggling in the reverseProxy process. An attacker can bypass routing-based authorization by sending a specially crafted Host header that matches a configured virtual host via substring, allowing unauthorized access to restricted routes. This is only exploitable if the deployment uses reverseProxy() or reverseProxyRouting() as a public-facing inbound HTTP handler with two or more configured virtual hosts.
Workaround
This vulnerability can be mitigated by wrapping reverseProxy() with a host-allow-list filter that requires an exact match against expected vhost names before delegating.