Replay Vulnerability in Http4s for Scala HTTP Services
CVE-2026-69206
What is CVE-2026-69206?
The Http4s library, utilized for Scala HTTP services, has a vulnerability in the DigestAuth mechanism that allows replay attacks. Specifically, the last nonce-count (nc) is incorrectly recorded, which leads to a scenario where a passive observer can replay captured Authorization headers. This occurs when legitimate clients send noncontiguous nc values due to parallel or retried requests, resulting in the stored counter being lower than the maximum accepted value. If exploited, attackers can successfully execute authenticated requests, including altering sensitive data, posing significant security risks. Users are encouraged to upgrade to versions 0.23.35 or 1.0.0-M47 to mitigate this issue.
Affected Version(s)
http4s < 0.23.35 < 0.23.35
http4s >= 1.0.0-M1, < 1.0.0-M47 < 1.0.0-M1, 1.0.0-M47