CVE-2026-100724
http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
CVSS score
6.3
EPSS probability
%0.3
Risk score
0.0
Published
16 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.5
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
H
Patch verifiedEPSS %1
8.1
CVE-2026-54148
http4k: `DigestAuthProvider.verify` did not bind to request URI
H
Patch verifiedEPSS %1
8.2
CVE-2026-100834
http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
H
Patch verifiedEPSS %0
8.3
CVE-2026-100725
http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
H
Patch verifiedEPSS %0
6.5
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
H
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-100724"