org.http4k:http4k-core
Maven · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact` | org.http4k:http4k-coreRed Hat Fuse 7/http4k-core | MavenRed Hat | Medium | Fix reported | |
| http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS | org.http4k:http4k-core | Maven | High | Fix reported | |
| http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac` | org.http4k:http4k-core | Maven | High | Fix reported | |
| http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default | org.http4k:http4k-core | Maven | Medium | Fix reported |