CVE-2026-100834GHSA-c7jm-38gq-h67h
http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
http4k http4kMavenLibraries & packages
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.48.0.0http4kCVE List
- 5.42.0.0http4kCVE List
- 4.51.0.0http4kCVE List
- 6.48.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>6.48.0.0</version></dependency> - 5.42.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>5.42.0.0</version></dependency> - 4.51.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>4.51.0.0</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
Text from CVE List
Affected versions 159
- http4kaffected: all versions before 6.48.0.0CVE List
- http4kunaffected: 6.48.0.0CVE List
- http4kaffected: all versions before 5.42.0.0CVE List
- http4kunaffected: 5.42.0.0CVE List
- http4kaffected: all versions before 4.51.0.0CVE List
- http4kunaffected: 4.51.0.0CVE List
- org.http4k:http4k-security-digest, Mavenfrom 6.0.0.0, fixed in 6.48.0.0OSV
- org.http4k:http4k-security-digest, Maven6.0.0.0OSV
- org.http4k:http4k-security-digest, Maven6.0.1.0OSV
- org.http4k:http4k-security-digest, Maven6.1.0.0OSV
- org.http4k:http4k-security-digest, Maven6.1.0.1OSV
- org.http4k:http4k-security-digest, Maven6.10.0.0OSV
- org.http4k:http4k-security-digest, Maven6.10.1.0OSV
- org.http4k:http4k-security-digest, Maven6.10.2.0OSV
- org.http4k:http4k-security-digest, Maven6.11.0.0OSV
- org.http4k:http4k-security-digest, Maven6.11.1.0OSV
- org.http4k:http4k-security-digest, Maven6.12.0.0OSV
- org.http4k:http4k-security-digest, Maven6.13.0.0OSV
- org.http4k:http4k-security-digest, Maven6.14.0.0OSV
- org.http4k:http4k-security-digest, Maven6.15.0.0OSV
- org.http4k:http4k-security-digest, Maven6.15.0.1OSV
- org.http4k:http4k-security-digest, Maven6.15.1.0OSV
- org.http4k:http4k-security-digest, Maven6.16.0.0OSV
- org.http4k:http4k-security-digest, Maven6.17.0.0OSV
- org.http4k:http4k-security-digest, Maven6.18.0.1OSV
- org.http4k:http4k-security-digest, Maven6.18.1.0OSV
- org.http4k:http4k-security-digest, Maven6.19.0.0OSV
- org.http4k:http4k-security-digest, Maven6.2.0.0OSV
- org.http4k:http4k-security-digest, Maven6.20.0.0OSV
- org.http4k:http4k-security-digest, Maven6.20.0.1OSV
- org.http4k:http4k-security-digest, Maven6.20.0.2OSV
- org.http4k:http4k-security-digest, Maven6.20.0.3OSV
- org.http4k:http4k-security-digest, Maven6.20.1.0OSV
- org.http4k:http4k-security-digest, Maven6.20.2.0OSV
- org.http4k:http4k-security-digest, Maven6.20.2.1OSV
- org.http4k:http4k-security-digest, Maven6.21.0.0OSV
- org.http4k:http4k-security-digest, Maven6.21.1.0OSV
- org.http4k:http4k-security-digest, Maven6.22.0.0OSV
- org.http4k:http4k-security-digest, Maven6.23.0.0OSV
- org.http4k:http4k-security-digest, Maven6.23.1.0OSV
- org.http4k:http4k-security-digest, Maven6.24.0.0OSV
- org.http4k:http4k-security-digest, Maven6.24.1.0OSV
- org.http4k:http4k-security-digest, Maven6.25.0.0OSV
- org.http4k:http4k-security-digest, Maven6.25.1.0OSV
- org.http4k:http4k-security-digest, Maven6.26.0.0OSV
- org.http4k:http4k-security-digest, Maven6.26.1.0OSV
- org.http4k:http4k-security-digest, Maven6.27.0.0OSV
- org.http4k:http4k-security-digest, Maven6.28.0.0OSV
- org.http4k:http4k-security-digest, Maven6.28.1.0OSV
- org.http4k:http4k-security-digest, Maven6.29.0.0OSV
- org.http4k:http4k-security-digest, Maven6.30.0.0OSV
- org.http4k:http4k-security-digest, Maven6.30.1.0OSV
- org.http4k:http4k-security-digest, Maven6.31.0.0OSV
- org.http4k:http4k-security-digest, Maven6.31.1.0OSV
- org.http4k:http4k-security-digest, Maven6.32.0.0OSV
- org.http4k:http4k-security-digest, Maven6.33.0.0OSV
- org.http4k:http4k-security-digest, Maven6.34.0.0OSV
- org.http4k:http4k-security-digest, Mavenfrom 5.0.0.0, fixed in 5.42.0.0OSV
- org.http4k:http4k-security-digest, Maven5.0.0.0OSV
- org.http4k:http4k-security-digest, Maven5.1.0.0OSV
- org.http4k:http4k-security-digest, Maven5.1.1.0OSV
- org.http4k:http4k-security-digest, Maven5.1.1.1OSV
- org.http4k:http4k-security-digest, Maven5.1.2.0OSV
- org.http4k:http4k-security-digest, Maven5.1.2.1OSV
- org.http4k:http4k-security-digest, Maven5.10.0.0OSV
- org.http4k:http4k-security-digest, Maven5.10.1.0OSV
- org.http4k:http4k-security-digest, Maven5.10.2.0OSV
- org.http4k:http4k-security-digest, Maven5.10.3.0OSV
- org.http4k:http4k-security-digest, Maven5.10.4.0OSV
- org.http4k:http4k-security-digest, Maven5.10.5.0OSV
- org.http4k:http4k-security-digest, Maven5.10.6.0OSV
- org.http4k:http4k-security-digest, Maven5.10.7.0OSV
- org.http4k:http4k-security-digest, Maven5.11.0.0OSV
- org.http4k:http4k-security-digest, Maven5.11.1.0OSV
- org.http4k:http4k-security-digest, Maven5.12.0.0OSV
- org.http4k:http4k-security-digest, Maven5.12.1.0OSV
- org.http4k:http4k-security-digest, Maven5.12.2.0OSV
- org.http4k:http4k-security-digest, Maven5.12.2.1OSV
- org.http4k:http4k-security-digest, Maven5.13.0.0OSV
- org.http4k:http4k-security-digest, Maven5.13.0.1OSV
- org.http4k:http4k-security-digest, Maven5.13.1.0OSV
- org.http4k:http4k-security-digest, Maven5.13.2.0OSV
- org.http4k:http4k-security-digest, Maven5.13.4.0OSV
- org.http4k:http4k-security-digest, Maven5.13.4.1OSV
- org.http4k:http4k-security-digest, Maven5.13.5.0OSV
- org.http4k:http4k-security-digest, Maven5.13.6.0OSV
- org.http4k:http4k-security-digest, Maven5.13.6.1OSV
- org.http4k:http4k-security-digest, Maven5.13.7.0OSV
- org.http4k:http4k-security-digest, Maven5.13.8.0OSV
- org.http4k:http4k-security-digest, Maven5.13.9.0OSV
- org.http4k:http4k-security-digest, Maven5.14.0.0OSV
- org.http4k:http4k-security-digest, Maven5.14.1.0OSV
- org.http4k:http4k-security-digest, Maven5.14.2.0OSV
- org.http4k:http4k-security-digest, Maven5.14.4.0OSV
- org.http4k:http4k-security-digest, Maven5.14.5.0OSV
- org.http4k:http4k-security-digest, Maven5.15.0.0OSV
- org.http4k:http4k-security-digest, Maven5.16.0.0OSV
- org.http4k:http4k-security-digest, Maven5.16.1.0OSV
- org.http4k:http4k-security-digest, Maven5.16.2.0OSV
- org.http4k:http4k-security-digest, Maven5.17.0.0OSV
- org.http4k:http4k-security-digest, Maven5.18.1.0OSV
- org.http4k:http4k-security-digest, Maven5.18.2.0OSV
- org.http4k:http4k-security-digest, Maven5.19.0.0OSV
- org.http4k:http4k-security-digest, Maven5.2.0.0OSV
- org.http4k:http4k-security-digest, Maven5.2.1.0OSV
- org.http4k:http4k-security-digest, Maven5.20.0.0OSV
- org.http4k:http4k-security-digest, Maven5.21.0.0OSV
- org.http4k:http4k-security-digest, Maven5.21.1.0OSV
- org.http4k:http4k-security-digest, Mavenfrom first release, fixed in 4.51.0.0OSV
- org.http4k:http4k-security-digest, Maven4.10.0.0.0OSV
- org.http4k:http4k-security-digest, Maven4.10.0.1OSV
- org.http4k:http4k-security-digest, Maven4.10.1.0OSV
- org.http4k:http4k-security-digest, Maven4.11.0.0OSV
- org.http4k:http4k-security-digest, Maven4.11.0.1OSV
- org.http4k:http4k-security-digest, Maven4.12.0.0OSV
- org.http4k:http4k-security-digest, Maven4.12.0.1OSV
- org.http4k:http4k-security-digest, Maven4.12.1.0OSV
- org.http4k:http4k-security-digest, Maven4.12.2.0OSV
- org.http4k:http4k-security-digest, Maven4.12.3.0OSV
- org.http4k:http4k-security-digest, Maven4.12.3.1OSV
- org.http4k:http4k-security-digest, Maven4.13.0.0OSV
- org.http4k:http4k-security-digest, Maven4.13.1.0OSV
- org.http4k:http4k-security-digest, Maven4.13.3.0OSV
- org.http4k:http4k-security-digest, Maven4.13.4.0OSV
- org.http4k:http4k-security-digest, Maven4.14.0.0OSV
- org.http4k:http4k-security-digest, Maven4.14.1.0OSV
- org.http4k:http4k-security-digest, Maven4.14.1.1OSV
- org.http4k:http4k-security-digest, Maven4.14.1.2OSV
- org.http4k:http4k-security-digest, Maven4.14.1.3OSV
- org.http4k:http4k-security-digest, Maven4.14.1.4OSV
- org.http4k:http4k-security-digest, Maven4.15.0.0OSV
- org.http4k:http4k-security-digest, Maven4.16.0.0OSV
- org.http4k:http4k-security-digest, Maven4.16.1.0OSV
- org.http4k:http4k-security-digest, Maven4.16.2.0OSV
- org.http4k:http4k-security-digest, Maven4.16.3.0OSV
- org.http4k:http4k-security-digest, Maven4.17.0.0OSV
- org.http4k:http4k-security-digest, Maven4.17.1.0OSV
- org.http4k:http4k-security-digest, Maven4.17.2.0OSV
- org.http4k:http4k-security-digest, Maven4.17.3.0OSV
- org.http4k:http4k-security-digest, Maven4.17.4.0OSV
- org.http4k:http4k-security-digest, Maven4.17.5.0OSV
- org.http4k:http4k-security-digest, Maven4.17.6.0OSV
- org.http4k:http4k-security-digest, Maven4.17.7.0OSV
- org.http4k:http4k-security-digest, Maven4.17.8.0OSV
- org.http4k:http4k-security-digest, Maven4.17.9.0OSV
- org.http4k:http4k-security-digest, Maven4.18.0.0OSV
- org.http4k:http4k-security-digest, Maven4.19.0.0OSV
- org.http4k:http4k-security-digest, Maven4.19.1.0OSV
- org.http4k:http4k-security-digest, Maven4.19.2.0OSV
- org.http4k:http4k-security-digest, Maven4.19.3.0OSV
- org.http4k:http4k-security-digest, Maven4.19.4.0OSV
- org.http4k:http4k-security-digest, Maven4.19.5.0OSV
- org.http4k:http4k-security-digest, Maven4.20.0.0OSV
- org.http4k:http4k-security-digest, Maven4.20.1.0OSV
- org.http4k:http4k-security-digest, Maven4.20.2.0OSV
- org.http4k:http4k-security-digest, Maven4.21.0.0OSV
- org.http4k:http4k-security-digest, Maven4.21.1.0OSV
- org.http4k:http4k-security-digest, Maven4.21.1.1OSV
- org.http4k:http4k-security-digest, Maven4.22.0.0OSV
References 4
- github.com/http4k/http4k/commit/8a52b615b1Fixvia CVE List
- github.com/http4k/http4k/commit/4f904b4692Fixvia CVE List
- github.com/http4k/http4k/security/advisories/GHSA-c7jm-38gq-h67hAdvisoryvia CVE List
- vulncheck.com/advisories/http4k-before-6.48.0.0-digest-authentication-replay-protection-bypassAdvisoryvia CVE List