{"schema":"threatline.record/2","record":{"id":"CVE-2026-54148","aliases":["GHSA-p28p-j94q-pg32"],"summary":"http4k: `DigestAuthProvider.verify` did not bind to request URI","details":"### Impact\n\nAn issue in `DigestAuthProvider.verify`:\n\nThe `uri` parameter in the client's `Authorization: Digest …` response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.\n\n**Who is affected:** any application using `http4k-security-digest` for HTTP Digest authentication. The bug has been present since `DigestAuthProvider` was introduced (commit `8a52b615b1`, 2021).\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.50.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v5.x line) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v4.x line) |\n\nThe fix:\n- Rejects credentials whose `uri` parameter does not match the request URL.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n- **URI binding gap:** place Digest auth behind a reverse proxy that pins requests to a single URL.\n\n### References\n\n- Vulnerability first present: [`8a52b615b1`](https://github.com/http4k/http4k/commit/8a52b615b1)\n- URI binding fix: [`725f1b9697`](https://github.com/http4k/http4k/commit/725f1b9697)\n- Fix release: [v6.50.0.0](https://github.com/http4k/http4k/releases/tag/6.50.0.0)\n- Background: [RFC 7616 — HTTP Digest Access Authentication](https://datatracker.ietf.org/doc/html/rfc7616)","categories":["Libraries & packages"],"product":"org.http4k:http4k-security-digest","vendor":"http4k","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"range":">= 6.0.0.0, < 6.50.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"range":">= 5.0.0.0, < 5.42.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"range":">= 4.0.0.0, < 4.51.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54148","source_modified_at":"2026-09-22T14:54:12.650Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"http4k","vendor":"http4k","versions":[{"version":"< 4.51.0.0","status":"affected"},{"version":">= 5.0.0.0, < 5.42.0.0","status":"affected"},{"version":">= 6.0.0.0, < 6.50.0.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.50.0.0"}]}],"versions":["6.0.0.0","6.0.1.0","6.1.0.0","6.1.0.1","6.10.0.0","6.10.1.0","6.10.2.0","6.11.0.0","6.11.1.0","6.12.0.0","6.13.0.0","6.14.0.0","6.15.0.0","6.15.0.1","6.15.1.0","6.16.0.0","6.17.0.0","6.18.0.1","6.18.1.0","6.19.0.0","6.2.0.0","6.20.0.0","6.20.0.1","6.20.0.2","6.20.0.3","6.20.1.0","6.20.2.0","6.20.2.1","6.21.0.0","6.21.1.0","6.22.0.0","6.23.0.0","6.23.1.0","6.24.0.0","6.24.1.0","6.25.0.0","6.25.1.0","6.26.0.0","6.26.1.0","6.27.0.0","6.28.0.0","6.28.1.0","6.29.0.0","6.30.0.0","6.30.1.0","6.31.0.0","6.31.1.0","6.32.0.0","6.33.0.0","6.34.0.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.42.0.0"}]}],"versions":["5.0.0.0","5.1.0.0","5.1.1.0","5.1.1.1","5.1.2.0","5.1.2.1","5.10.0.0","5.10.1.0","5.10.2.0","5.10.3.0","5.10.4.0","5.10.5.0","5.10.6.0","5.10.7.0","5.11.0.0","5.11.1.0","5.12.0.0","5.12.1.0","5.12.2.0","5.12.2.1","5.13.0.0","5.13.0.1","5.13.1.0","5.13.2.0","5.13.4.0","5.13.4.1","5.13.5.0","5.13.6.0","5.13.6.1","5.13.7.0","5.13.8.0","5.13.9.0","5.14.0.0","5.14.1.0","5.14.2.0","5.14.4.0","5.14.5.0","5.15.0.0","5.16.0.0","5.16.1.0","5.16.2.0","5.17.0.0","5.18.1.0","5.18.2.0","5.19.0.0","5.2.0.0","5.2.1.0","5.20.0.0","5.21.0.0","5.21.1.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.0"},{"fixed":"4.51.0.0"}]}],"versions":["4.10.0.0.0","4.10.0.1","4.10.1.0","4.11.0.0","4.11.0.1","4.12.0.0","4.12.0.1","4.12.1.0","4.12.2.0","4.12.3.0","4.12.3.1","4.13.0.0","4.13.1.0","4.13.3.0","4.13.4.0","4.14.0.0","4.14.1.0","4.14.1.1","4.14.1.2","4.14.1.3","4.14.1.4","4.15.0.0","4.16.0.0","4.16.1.0","4.16.2.0","4.16.3.0","4.17.0.0","4.17.1.0","4.17.2.0","4.17.3.0","4.17.4.0","4.17.5.0","4.17.6.0","4.17.7.0","4.17.8.0","4.17.9.0","4.18.0.0","4.19.0.0","4.19.1.0","4.19.2.0","4.19.3.0","4.19.4.0","4.19.5.0","4.20.0.0","4.20.1.0","4.20.2.0","4.21.0.0","4.21.1.0","4.21.1.1","4.22.0.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"version":"6.50.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"version":"5.42.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T14:47:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-security-digest"},"version":"4.51.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"6.50.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"5.42.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","source_modified_at":"2026-09-24T15:00:04.968303239Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-security-digest","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-security-digest"},"version":"4.51.0.0"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0058,"percentile":0.4701,"score_date":"2026-10-23"},"published_at":"2026-09-18T16:09:44.361Z","modified_at":"2026-09-24T15:00:04.968303239Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T14:47:14Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-54148","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-22T14:54:12.650Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-p28p-j94q-pg32","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-24T15:00:04.968303239Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54148","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/http4k/http4k/security/advisories/GHSA-p28p-j94q-pg32","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/http4k/http4k/commit/725f1b9697","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/http4k/http4k/releases/tag/6.50.0.0","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54148","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/github/advisory-database/pull/9477","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/http4k/http4k/commit/725f1b96978dd433348e2b149c1e72b9f5147c90","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-p28p-j94q-pg32","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-22T14:53:41.032948Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-24T15:00:04.968303239Z","content_hash":"d195a36e8c9942bed4ad547c647f76320779c9047c846b80533c88074229ced8"}}