CVE-2026-100724
1 advisory.
Maven/org.http4k:http4k-core CVE-2026-100724: medium
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Action: Upgrade org.http4k:http4k-core to 4.51.0.0 (4.x), 5.42.0.0 (5.x) or 6.49.0.0 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0.0 | 6.49.0.0 | - |
| 5.0.0.0 | 5.42.0.0 | - |
| 0 | 4.51.0.0 | - |
Fixed versions
| 6.49.0.0 | 5.42.0.0 | 4.51.0.0 |
Sources
- osv: GHSA-jrpc-7vxp-69p6
- https://github.com/http4k/http4k/security/advisories/GHSA-jrpc-7vxp-69p6
- https://github.com/http4k/http4k/commit/0121b05537
- https://github.com/http4k/http4k/commit/54c6385615
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/releases/tag/6.49.0.0
CVE-2026-100724 · published · modified · JSON