CVE-2026-120317: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Published Nov 2, 2026

Updated

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

Event History

Nov 2, 2026

CVE Published

via OSV·02:01 AM

Data Sourced

via OSV·02:01 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using http4k versions from 4.9.10.0 before 6.60.0.0 are affected when Digest authentication uses auth-int over a non-TLS channel. The described attack requires an attacker to be on the network path.

Does an attacker need the victim's credentials?

The attacker can alter the body of an already authenticated request while retaining a valid Authorization header. This can cause state-changing actions to execute as the authenticated victim.

What can be done before upgrading?

Do not send authenticated Digest auth-int requests over non-TLS channels. Enforcing TLS removes the non-TLS condition described for the on-path body-rewrite attack.

How can I determine whether my application is affected?

Check whether the application uses an http4k version from 4.9.10.0 up to, but not including, 6.60.0.0, and whether its DigestEncoder is used for auth-int authentication. Exposure also depends on authenticated requests traversing a non-TLS channel.

CVE-2026-120317: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Event History

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need the victim's credentials?

What can be done before upgrading?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need the victim's credentials?

What can be done before upgrading?

How can I determine whether my application is affected?