{"schema":"threatline.record/2","record":{"id":"CVE-2026-100834","aliases":["GHSA-c7jm-38gq-h67h"],"summary":"http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass","details":"http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.","categories":["Libraries & packages"],"product":"http4k","vendor":"http4k","ecosystem":"Maven","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"http4k","vendor":"http4k","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"6.48.0.0"},{"version":"6.48.0.0","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"http4k","vendor":"http4k","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"5.42.0.0"},{"version":"5.42.0.0","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"http4k","vendor":"http4k","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"4.51.0.0"},{"version":"4.51.0.0","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.48.0.0"}]}],"versions":["6.0.0.0","6.0.1.0","6.1.0.0","6.1.0.1","6.10.0.0","6.10.1.0","6.10.2.0","6.11.0.0","6.11.1.0","6.12.0.0","6.13.0.0","6.14.0.0","6.15.0.0","6.15.0.1","6.15.1.0","6.16.0.0","6.17.0.0","6.18.0.1","6.18.1.0","6.19.0.0","6.2.0.0","6.20.0.0","6.20.0.1","6.20.0.2","6.20.0.3","6.20.1.0","6.20.2.0","6.20.2.1","6.21.0.0","6.21.1.0","6.22.0.0","6.23.0.0","6.23.1.0","6.24.0.0","6.24.1.0","6.25.0.0","6.25.1.0","6.26.0.0","6.26.1.0","6.27.0.0","6.28.0.0","6.28.1.0","6.29.0.0","6.30.0.0","6.30.1.0","6.31.0.0","6.31.1.0","6.32.0.0","6.33.0.0","6.34.0.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.42.0.0"}]}],"versions":["5.0.0.0","5.1.0.0","5.1.1.0","5.1.1.1","5.1.2.0","5.1.2.1","5.10.0.0","5.10.1.0","5.10.2.0","5.10.3.0","5.10.4.0","5.10.5.0","5.10.6.0","5.10.7.0","5.11.0.0","5.11.1.0","5.12.0.0","5.12.1.0","5.12.2.0","5.12.2.1","5.13.0.0","5.13.0.1","5.13.1.0","5.13.2.0","5.13.4.0","5.13.4.1","5.13.5.0","5.13.6.0","5.13.6.1","5.13.7.0","5.13.8.0","5.13.9.0","5.14.0.0","5.14.1.0","5.14.2.0","5.14.4.0","5.14.5.0","5.15.0.0","5.16.0.0","5.16.1.0","5.16.2.0","5.17.0.0","5.18.1.0","5.18.2.0","5.19.0.0","5.2.0.0","5.2.1.0","5.20.0.0","5.21.0.0","5.21.1.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.51.0.0"}]}],"versions":["4.10.0.0.0","4.10.0.1","4.10.1.0","4.11.0.0","4.11.0.1","4.12.0.0","4.12.0.1","4.12.1.0","4.12.2.0","4.12.3.0","4.12.3.1","4.13.0.0","4.13.1.0","4.13.3.0","4.13.4.0","4.14.0.0","4.14.1.0","4.14.1.1","4.14.1.2","4.14.1.3","4.14.1.4","4.15.0.0","4.16.0.0","4.16.1.0","4.16.2.0","4.16.3.0","4.17.0.0","4.17.1.0","4.17.2.0","4.17.3.0","4.17.4.0","4.17.5.0","4.17.6.0","4.17.7.0","4.17.8.0","4.17.9.0","4.18.0.0","4.19.0.0","4.19.1.0","4.19.2.0","4.19.3.0","4.19.4.0","4.19.5.0","4.20.0.0","4.20.1.0","4.20.2.0","4.21.0.0","4.21.1.0","4.21.1.1","4.22.0.0"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"http4k","ecosystem":null},"version":"6.48.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"http4k","ecosystem":null},"version":"5.42.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","source_modified_at":"2026-09-30T17:03:58.285Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"http4k","ecosystem":null},"version":"4.51.0.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"6.48.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"5.42.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","source_modified_at":"2026-09-27T11:56:09.133572902Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"4.51.0.0"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0032,"percentile":0.23839,"score_date":"2026-10-23"},"published_at":"2026-09-27T01:28:32.781Z","modified_at":"2026-09-30T17:03:58.285Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100834","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T17:03:58.285Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-c7jm-38gq-h67h","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-27T11:56:09.133572902Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100834","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/http4k/http4k/security/advisories/GHSA-c7jm-38gq-h67h","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/http4k/http4k/commit/8a52b615b1","tags":["patch"]},{"source":"CVE List","url":"https://github.com/http4k/http4k/commit/4f904b4692","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-digest-authentication-replay-protection-bypass","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T17:03:50.406355Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T17:03:58.285Z","content_hash":"7b023f73f546616659fd3a5fcd99c24e0a6e600343d05fb0769a4c837a1d9d3c"}}