Threats affecting pkg:maven/org.http4k/http4k-core

http4k-core versions before 6.49.0.0, 5.42.0.0, and 4.51.0.0 use substring matching on the Host header in reverseProxy() and reverseProxyRouting() functions. This behavior can allow an attacker to bypass routing-based authorization by supplying a Host header that contains a configured virtual host name as a substring. This issue affects public-facing inbound HTTP handlers with multiple configured virtual hosts. The vulnerability does not affect outbound dispatch or test-time uses where the Host header is set by the application.

http4k-core versions before 6.48.0.0, 5.42.0.0, and 4.51.0.0 include a BasicCookieStorage implementation that does not properly enforce RFC 6265 cookie scoping rules. This flaw allows cookies intended for one origin or scheme to be sent to others, and Secure cookies may be transmitted over unencrypted HTTP connections. Clients using BasicCookieStorage for multiple origins or schemes are affected, while those using it for a single origin are not.