CVE-2026-120317 is a high-severity vulnerability in http4k versions from 4.9.10.0 before 6.60.0.0. The vulnerability is due to a missing integrity check in DigestEncoder, which allows on-path attackers to rewrite the body of authenticated requests without invalidating the Authorization header. This can lead to state-changing actions being executed as the victim. Affected http4k deployments should be verif [truncated]
CVE-2026-120316 is a path traversal vulnerability in http4k before 6.62.0.0-ee, specifically in ThymeleafTemplates Caching and HotReload. This allows unauthenticated attackers to read files outside the baseTemplateDir by manipulating ViewModel.template() values with ../ segments. The vulnerability is considered High with a CVSS score of 8.2. Affected product deployments should be identified, and owners as [truncated]
