Digest Authentication Vulnerability in Http4s by http4s
CVE-2026-69208
7.5HIGH
What is CVE-2026-69208?
The DigestAuth server middleware in Http4s, prior to versions 0.23.35 and 1.0.0-M47, exhibits a flaw where it removes fresh nonces incorrectly and ceases eviction upon encountering the first stale nonce. An unauthenticated attacker can exploit this inverse comparison in applications that protect routes with DigestAuth. By repeatedly triggering authentication challenges, the persistent nonce map can grow indefinitely, potentially leading to JVM heap memory exhaustion. Users are encouraged to upgrade to the specified releases to mitigate this issue.
Affected Version(s)
http4s < 0.23.35 < 0.23.35
http4s >= 1.0.0-M1, < 1.0.0-M47 < 1.0.0-M1, 1.0.0-M47