Information Exposure Affecting org.http4k:http4k-core package, versions [,4.51.0.0)[5.0.0.0,5.42.0.0)[6.0.0.0,6.48.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGHTTP4K-17732800
- published30 Jun 2026
- disclosed19 Jun 2026
- creditUnknown
Introduced: 19 Jun 2026
CVE NOT AVAILABLE CWE-200 (opens in a new tab)How to fix?
Upgrade org.http4k:http4k-core to version 4.51.0.0, 5.42.0.0, 6.48.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure in the BasicCookieStorage process, which does not enforce proper scoping rules for cookies as specified in RFC 6265. An attacker can access or receive cookies intended for other domains or schemes by leveraging a single storage instance across multiple origins or by sending Secure cookies over plain HTTP. This is only exploitable if a client uses the same storage instance for multiple origins or schemes.
Workaround
This vulnerability can be mitigated by using a dedicated BasicCookieStorage instance per origin or scheme, or by switching to a separate RFC 6265-compliant cookie store implementation.