CVE-2026-100725
1 advisory.
Maven/org.http4k:http4k-core CVE-2026-100725: medium
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
Action: Upgrade org.http4k:http4k-core to 4.51.0.0 (4.x), 5.42.0.0 (5.x) or 6.48.0.0 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0.0 | 6.48.0.0 | - |
| 5.0.0.0 | 5.42.0.0 | - |
| 0 | 4.51.0.0 | - |
Fixed versions
| 6.48.0.0 | 5.42.0.0 | 4.51.0.0 |
Sources
- osv: GHSA-pr33-38xx-6r26
- https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26
- https://github.com/http4k/http4k/commit/6a9b44d743
- https://datatracker.ietf.org/doc/html/rfc6265
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/releases/tag/6.48.0.0
CVE-2026-100725 · published · modified · JSON