All vulnerabilities
CVE-2026-100724GHSA-jrpc-7vxp-69p6

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

http4k http4kMavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.49.0.0Also 5.42.0.0, 4.51.0.0CVE List
Published27 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 6.49.0.0http4kCVE List
  • 5.42.0.0http4kCVE List
  • 4.51.0.0http4kCVE List
  • 6.49.0.0org.http4k:http4k-core, MavenOSV<dependency><groupId>org.http4k</groupId><artifactId>http4k-core</artifactId><version>6.49.0.0</version></dependency>
  • 5.42.0.0org.http4k:http4k-core, MavenOSV<dependency><groupId>org.http4k</groupId><artifactId>http4k-core</artifactId><version>5.42.0.0</version></dependency>
  • 4.51.0.0org.http4k:http4k-core, MavenOSV<dependency><groupId>org.http4k</groupId><artifactId>http4k-core</artifactId><version>4.51.0.0</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

Text from CVE List

Affected versions 159

  • http4kaffected: all versions before 6.49.0.0CVE List
  • http4kunaffected: 6.49.0.0CVE List
  • http4kaffected: all versions before 5.42.0.0CVE List
  • http4kunaffected: 5.42.0.0CVE List
  • http4kaffected: all versions before 4.51.0.0CVE List
  • http4kunaffected: 4.51.0.0CVE List
  • org.http4k:http4k-core, Mavenfrom 6.0.0.0, fixed in 6.49.0.0OSV
  • org.http4k:http4k-core, Maven6.0.0.0OSV
  • org.http4k:http4k-core, Maven6.0.1.0OSV
  • org.http4k:http4k-core, Maven6.1.0.0OSV
  • org.http4k:http4k-core, Maven6.1.0.1OSV
  • org.http4k:http4k-core, Maven6.10.0.0OSV
  • org.http4k:http4k-core, Maven6.10.1.0OSV
  • org.http4k:http4k-core, Maven6.10.2.0OSV
  • org.http4k:http4k-core, Maven6.11.0.0OSV
  • org.http4k:http4k-core, Maven6.11.1.0OSV
  • org.http4k:http4k-core, Maven6.12.0.0OSV
  • org.http4k:http4k-core, Maven6.13.0.0OSV
  • org.http4k:http4k-core, Maven6.14.0.0OSV
  • org.http4k:http4k-core, Maven6.15.0.0OSV
  • org.http4k:http4k-core, Maven6.15.0.1OSV
  • org.http4k:http4k-core, Maven6.15.1.0OSV
  • org.http4k:http4k-core, Maven6.16.0.0OSV
  • org.http4k:http4k-core, Maven6.17.0.0OSV
  • org.http4k:http4k-core, Maven6.18.0.1OSV
  • org.http4k:http4k-core, Maven6.18.1.0OSV
  • org.http4k:http4k-core, Maven6.19.0.0OSV
  • org.http4k:http4k-core, Maven6.2.0.0OSV
  • org.http4k:http4k-core, Maven6.20.0.0OSV
  • org.http4k:http4k-core, Maven6.20.0.1OSV
  • org.http4k:http4k-core, Maven6.20.0.2OSV
  • org.http4k:http4k-core, Maven6.20.0.3OSV
  • org.http4k:http4k-core, Maven6.20.1.0OSV
  • org.http4k:http4k-core, Maven6.20.2.0OSV
  • org.http4k:http4k-core, Maven6.20.2.1OSV
  • org.http4k:http4k-core, Maven6.21.0.0OSV
  • org.http4k:http4k-core, Maven6.21.1.0OSV
  • org.http4k:http4k-core, Maven6.22.0.0OSV
  • org.http4k:http4k-core, Maven6.23.0.0OSV
  • org.http4k:http4k-core, Maven6.23.1.0OSV
  • org.http4k:http4k-core, Maven6.24.0.0OSV
  • org.http4k:http4k-core, Maven6.24.1.0OSV
  • org.http4k:http4k-core, Maven6.25.0.0OSV
  • org.http4k:http4k-core, Maven6.25.1.0OSV
  • org.http4k:http4k-core, Maven6.26.0.0OSV
  • org.http4k:http4k-core, Maven6.26.1.0OSV
  • org.http4k:http4k-core, Maven6.27.0.0OSV
  • org.http4k:http4k-core, Maven6.28.0.0OSV
  • org.http4k:http4k-core, Maven6.28.1.0OSV
  • org.http4k:http4k-core, Maven6.29.0.0OSV
  • org.http4k:http4k-core, Maven6.30.0.0OSV
  • org.http4k:http4k-core, Maven6.30.1.0OSV
  • org.http4k:http4k-core, Maven6.31.0.0OSV
  • org.http4k:http4k-core, Maven6.31.1.0OSV
  • org.http4k:http4k-core, Maven6.32.0.0OSV
  • org.http4k:http4k-core, Maven6.33.0.0OSV
  • org.http4k:http4k-core, Maven6.34.0.0OSV
  • org.http4k:http4k-core, Mavenfrom 5.0.0.0, fixed in 5.42.0.0OSV
  • org.http4k:http4k-core, Maven5.0.0.0OSV
  • org.http4k:http4k-core, Maven5.1.0.0OSV
  • org.http4k:http4k-core, Maven5.1.1.0OSV
  • org.http4k:http4k-core, Maven5.1.1.1OSV
  • org.http4k:http4k-core, Maven5.1.2.0OSV
  • org.http4k:http4k-core, Maven5.1.2.1OSV
  • org.http4k:http4k-core, Maven5.10.0.0OSV
  • org.http4k:http4k-core, Maven5.10.1.0OSV
  • org.http4k:http4k-core, Maven5.10.2.0OSV
  • org.http4k:http4k-core, Maven5.10.3.0OSV
  • org.http4k:http4k-core, Maven5.10.4.0OSV
  • org.http4k:http4k-core, Maven5.10.5.0OSV
  • org.http4k:http4k-core, Maven5.10.6.0OSV
  • org.http4k:http4k-core, Maven5.10.7.0OSV
  • org.http4k:http4k-core, Maven5.11.0.0OSV
  • org.http4k:http4k-core, Maven5.11.1.0OSV
  • org.http4k:http4k-core, Maven5.12.0.0OSV
  • org.http4k:http4k-core, Maven5.12.1.0OSV
  • org.http4k:http4k-core, Maven5.12.2.0OSV
  • org.http4k:http4k-core, Maven5.12.2.1OSV
  • org.http4k:http4k-core, Maven5.13.0.0OSV
  • org.http4k:http4k-core, Maven5.13.0.1OSV
  • org.http4k:http4k-core, Maven5.13.1.0OSV
  • org.http4k:http4k-core, Maven5.13.2.0OSV
  • org.http4k:http4k-core, Maven5.13.4.0OSV
  • org.http4k:http4k-core, Maven5.13.4.1OSV
  • org.http4k:http4k-core, Maven5.13.5.0OSV
  • org.http4k:http4k-core, Maven5.13.6.0OSV
  • org.http4k:http4k-core, Maven5.13.6.1OSV
  • org.http4k:http4k-core, Maven5.13.7.0OSV
  • org.http4k:http4k-core, Maven5.13.8.0OSV
  • org.http4k:http4k-core, Maven5.13.9.0OSV
  • org.http4k:http4k-core, Maven5.14.0.0OSV
  • org.http4k:http4k-core, Maven5.14.1.0OSV
  • org.http4k:http4k-core, Maven5.14.2.0OSV
  • org.http4k:http4k-core, Maven5.14.4.0OSV
  • org.http4k:http4k-core, Maven5.14.5.0OSV
  • org.http4k:http4k-core, Maven5.15.0.0OSV
  • org.http4k:http4k-core, Maven5.16.0.0OSV
  • org.http4k:http4k-core, Maven5.16.1.0OSV
  • org.http4k:http4k-core, Maven5.16.2.0OSV
  • org.http4k:http4k-core, Maven5.17.0.0OSV
  • org.http4k:http4k-core, Maven5.18.1.0OSV
  • org.http4k:http4k-core, Maven5.18.2.0OSV
  • org.http4k:http4k-core, Maven5.19.0.0OSV
  • org.http4k:http4k-core, Maven5.2.0.0OSV
  • org.http4k:http4k-core, Maven5.2.1.0OSV
  • org.http4k:http4k-core, Maven5.20.0.0OSV
  • org.http4k:http4k-core, Maven5.21.0.0OSV
  • org.http4k:http4k-core, Maven5.21.1.0OSV
  • org.http4k:http4k-core, Mavenfrom first release, fixed in 4.51.0.0OSV
  • org.http4k:http4k-core, Maven0.21.0OSV
  • org.http4k:http4k-core, Maven0.22.0OSV
  • org.http4k:http4k-core, Maven1.0.0OSV
  • org.http4k:http4k-core, Maven1.1.0OSV
  • org.http4k:http4k-core, Maven1.10.0OSV
  • org.http4k:http4k-core, Maven1.11.0OSV
  • org.http4k:http4k-core, Maven1.13.0OSV
  • org.http4k:http4k-core, Maven1.14.0OSV
  • org.http4k:http4k-core, Maven1.15.0OSV
  • org.http4k:http4k-core, Maven1.16.0OSV
  • org.http4k:http4k-core, Maven1.17.0OSV
  • org.http4k:http4k-core, Maven1.18.0OSV
  • org.http4k:http4k-core, Maven1.19.0OSV
  • org.http4k:http4k-core, Maven1.19.1OSV
  • org.http4k:http4k-core, Maven1.2.0OSV
  • org.http4k:http4k-core, Maven1.20.0OSV
  • org.http4k:http4k-core, Maven1.21.0OSV
  • org.http4k:http4k-core, Maven1.21.1OSV
  • org.http4k:http4k-core, Maven1.22.0OSV
  • org.http4k:http4k-core, Maven1.22.2OSV
  • org.http4k:http4k-core, Maven1.23.0OSV
  • org.http4k:http4k-core, Maven1.24.0OSV
  • org.http4k:http4k-core, Maven1.25.0OSV
  • org.http4k:http4k-core, Maven1.25.1OSV
  • org.http4k:http4k-core, Maven1.26.0OSV
  • org.http4k:http4k-core, Maven1.26.1OSV
  • org.http4k:http4k-core, Maven1.26.2OSV
  • org.http4k:http4k-core, Maven1.27.0OSV
  • org.http4k:http4k-core, Maven1.28.0OSV
  • org.http4k:http4k-core, Maven1.3.0OSV
  • org.http4k:http4k-core, Maven1.30.0OSV
  • org.http4k:http4k-core, Maven1.31.0OSV
  • org.http4k:http4k-core, Maven1.32.0OSV
  • org.http4k:http4k-core, Maven1.32.1OSV
  • org.http4k:http4k-core, Maven1.32.2OSV
  • org.http4k:http4k-core, Maven1.33.0OSV
  • org.http4k:http4k-core, Maven1.33.1OSV
  • org.http4k:http4k-core, Maven1.4.0OSV
  • org.http4k:http4k-core, Maven1.5.0OSV
  • org.http4k:http4k-core, Maven1.6.0OSV
  • org.http4k:http4k-core, Maven1.7.0OSV
  • org.http4k:http4k-core, Maven1.8.0OSV
  • org.http4k:http4k-core, Maven1.9.0OSV
  • org.http4k:http4k-core, Maven2.0.0OSV
  • org.http4k:http4k-core, Maven2.0.1OSV
  • org.http4k:http4k-core, Maven2.0.2OSV
  • org.http4k:http4k-core, Maven2.0.3OSV
  • org.http4k:http4k-core, Maven2.0.4OSV
  • org.http4k:http4k-core, Maven2.0.5OSV
  • org.http4k:http4k-core, Maven2.1.0OSV

References 4