CVE-2026-69208: Http4s: DigestAuth nonce map grows unbounded
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using the Http4s DigestAuth server middleware to protect at least one route are exposed when running versions earlier than 0.23.35 or 1.0.0-M47.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can repeatedly trigger authentication challenges against a DigestAuth-protected route.
What is the practical impact of exploitation?
Repeated challenges cause the persistent nonce map to grow without bound until the JVM exhausts heap memory, resulting in denial of service.
What versions contain the fix?
The issue is fixed in Http4s 0.23.35 and 1.0.0-M47.