CVE-2026-54148GHSA-p28p-j94q-pg32
org.http4k:http4k-security-digest: http4k: `DigestAuthProvider.verify` did not bind to request URI
http4k org.http4k:http4k-security-digestmavenLibraries & packages
CVSS
8.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.50.0.0org.http4k:http4k-security-digest, mavenGitHub
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>6.50.0.0</version></dependency> - 5.42.0.0org.http4k:http4k-security-digest, mavenGitHub
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>5.42.0.0</version></dependency> - 4.51.0.0org.http4k:http4k-security-digest, mavenGitHub
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>4.51.0.0</version></dependency> - 6.50.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>6.50.0.0</version></dependency> - 5.42.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>5.42.0.0</version></dependency> - 4.51.0.0org.http4k:http4k-security-digest, MavenOSV
<dependency><groupId>org.http4k</groupId><artifactId>http4k-security-digest</artifactId><version>4.51.0.0</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Impact
An issue in DigestAuthProvider.verify:
The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
Patches
| Line | Fixed in | Edition | |------|----------|---------| | v6.x (Community) | 6.50.0.0 | Community | | v5.x (LTS) | 5.42.0.0 | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v5.x line) | | v4.x (LTS) | 4.51.0.0 | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if Digest auth is present in your v4.x line) |
The fix:
- Rejects credentials whose
uriparameter does not match the request URL.
Workarounds
For deployments that cannot upgrade immediately:
- URI binding gap: place Digest auth behind a reverse proxy that pins requests to a single URL.
References
- Vulnerability first present: [
8a52b615b1](https://github.com/http4k/http4k/commit/8a52b615b1) - URI binding fix: [
725f1b9697](https://github.com/http4k/http4k/commit/725f1b9697) - Fix release: v6.50.0.0
- Background: RFC 7616 — HTTP Digest Access Authentication
Text from GitHub Advisory Database
Affected versions 159
- org.http4k:http4k-security-digest, maven>= 6.0.0.0, < 6.50.0.0GitHub
- org.http4k:http4k-security-digest, maven>= 5.0.0.0, < 5.42.0.0GitHub
- org.http4k:http4k-security-digest, maven>= 4.0.0.0, < 4.51.0.0GitHub
- http4kaffected: < 4.51.0.0CVE List
- http4kaffected: >= 5.0.0.0, < 5.42.0.0CVE List
- http4kaffected: >= 6.0.0.0, < 6.50.0.0CVE List
- org.http4k:http4k-security-digest, Mavenfrom 6.0.0.0, fixed in 6.50.0.0OSV
- org.http4k:http4k-security-digest, Maven6.0.0.0OSV
- org.http4k:http4k-security-digest, Maven6.0.1.0OSV
- org.http4k:http4k-security-digest, Maven6.1.0.0OSV
- org.http4k:http4k-security-digest, Maven6.1.0.1OSV
- org.http4k:http4k-security-digest, Maven6.10.0.0OSV
- org.http4k:http4k-security-digest, Maven6.10.1.0OSV
- org.http4k:http4k-security-digest, Maven6.10.2.0OSV
- org.http4k:http4k-security-digest, Maven6.11.0.0OSV
- org.http4k:http4k-security-digest, Maven6.11.1.0OSV
- org.http4k:http4k-security-digest, Maven6.12.0.0OSV
- org.http4k:http4k-security-digest, Maven6.13.0.0OSV
- org.http4k:http4k-security-digest, Maven6.14.0.0OSV
- org.http4k:http4k-security-digest, Maven6.15.0.0OSV
- org.http4k:http4k-security-digest, Maven6.15.0.1OSV
- org.http4k:http4k-security-digest, Maven6.15.1.0OSV
- org.http4k:http4k-security-digest, Maven6.16.0.0OSV
- org.http4k:http4k-security-digest, Maven6.17.0.0OSV
- org.http4k:http4k-security-digest, Maven6.18.0.1OSV
- org.http4k:http4k-security-digest, Maven6.18.1.0OSV
- org.http4k:http4k-security-digest, Maven6.19.0.0OSV
- org.http4k:http4k-security-digest, Maven6.2.0.0OSV
- org.http4k:http4k-security-digest, Maven6.20.0.0OSV
- org.http4k:http4k-security-digest, Maven6.20.0.1OSV
- org.http4k:http4k-security-digest, Maven6.20.0.2OSV
- org.http4k:http4k-security-digest, Maven6.20.0.3OSV
- org.http4k:http4k-security-digest, Maven6.20.1.0OSV
- org.http4k:http4k-security-digest, Maven6.20.2.0OSV
- org.http4k:http4k-security-digest, Maven6.20.2.1OSV
- org.http4k:http4k-security-digest, Maven6.21.0.0OSV
- org.http4k:http4k-security-digest, Maven6.21.1.0OSV
- org.http4k:http4k-security-digest, Maven6.22.0.0OSV
- org.http4k:http4k-security-digest, Maven6.23.0.0OSV
- org.http4k:http4k-security-digest, Maven6.23.1.0OSV
- org.http4k:http4k-security-digest, Maven6.24.0.0OSV
- org.http4k:http4k-security-digest, Maven6.24.1.0OSV
- org.http4k:http4k-security-digest, Maven6.25.0.0OSV
- org.http4k:http4k-security-digest, Maven6.25.1.0OSV
- org.http4k:http4k-security-digest, Maven6.26.0.0OSV
- org.http4k:http4k-security-digest, Maven6.26.1.0OSV
- org.http4k:http4k-security-digest, Maven6.27.0.0OSV
- org.http4k:http4k-security-digest, Maven6.28.0.0OSV
- org.http4k:http4k-security-digest, Maven6.28.1.0OSV
- org.http4k:http4k-security-digest, Maven6.29.0.0OSV
- org.http4k:http4k-security-digest, Maven6.30.0.0OSV
- org.http4k:http4k-security-digest, Maven6.30.1.0OSV
- org.http4k:http4k-security-digest, Maven6.31.0.0OSV
- org.http4k:http4k-security-digest, Maven6.31.1.0OSV
- org.http4k:http4k-security-digest, Maven6.32.0.0OSV
- org.http4k:http4k-security-digest, Maven6.33.0.0OSV
- org.http4k:http4k-security-digest, Maven6.34.0.0OSV
- org.http4k:http4k-security-digest, Mavenfrom 5.0.0.0, fixed in 5.42.0.0OSV
- org.http4k:http4k-security-digest, Maven5.0.0.0OSV
- org.http4k:http4k-security-digest, Maven5.1.0.0OSV
- org.http4k:http4k-security-digest, Maven5.1.1.0OSV
- org.http4k:http4k-security-digest, Maven5.1.1.1OSV
- org.http4k:http4k-security-digest, Maven5.1.2.0OSV
- org.http4k:http4k-security-digest, Maven5.1.2.1OSV
- org.http4k:http4k-security-digest, Maven5.10.0.0OSV
- org.http4k:http4k-security-digest, Maven5.10.1.0OSV
- org.http4k:http4k-security-digest, Maven5.10.2.0OSV
- org.http4k:http4k-security-digest, Maven5.10.3.0OSV
- org.http4k:http4k-security-digest, Maven5.10.4.0OSV
- org.http4k:http4k-security-digest, Maven5.10.5.0OSV
- org.http4k:http4k-security-digest, Maven5.10.6.0OSV
- org.http4k:http4k-security-digest, Maven5.10.7.0OSV
- org.http4k:http4k-security-digest, Maven5.11.0.0OSV
- org.http4k:http4k-security-digest, Maven5.11.1.0OSV
- org.http4k:http4k-security-digest, Maven5.12.0.0OSV
- org.http4k:http4k-security-digest, Maven5.12.1.0OSV
- org.http4k:http4k-security-digest, Maven5.12.2.0OSV
- org.http4k:http4k-security-digest, Maven5.12.2.1OSV
- org.http4k:http4k-security-digest, Maven5.13.0.0OSV
- org.http4k:http4k-security-digest, Maven5.13.0.1OSV
- org.http4k:http4k-security-digest, Maven5.13.1.0OSV
- org.http4k:http4k-security-digest, Maven5.13.2.0OSV
- org.http4k:http4k-security-digest, Maven5.13.4.0OSV
- org.http4k:http4k-security-digest, Maven5.13.4.1OSV
- org.http4k:http4k-security-digest, Maven5.13.5.0OSV
- org.http4k:http4k-security-digest, Maven5.13.6.0OSV
- org.http4k:http4k-security-digest, Maven5.13.6.1OSV
- org.http4k:http4k-security-digest, Maven5.13.7.0OSV
- org.http4k:http4k-security-digest, Maven5.13.8.0OSV
- org.http4k:http4k-security-digest, Maven5.13.9.0OSV
- org.http4k:http4k-security-digest, Maven5.14.0.0OSV
- org.http4k:http4k-security-digest, Maven5.14.1.0OSV
- org.http4k:http4k-security-digest, Maven5.14.2.0OSV
- org.http4k:http4k-security-digest, Maven5.14.4.0OSV
- org.http4k:http4k-security-digest, Maven5.14.5.0OSV
- org.http4k:http4k-security-digest, Maven5.15.0.0OSV
- org.http4k:http4k-security-digest, Maven5.16.0.0OSV
- org.http4k:http4k-security-digest, Maven5.16.1.0OSV
- org.http4k:http4k-security-digest, Maven5.16.2.0OSV
- org.http4k:http4k-security-digest, Maven5.17.0.0OSV
- org.http4k:http4k-security-digest, Maven5.18.1.0OSV
- org.http4k:http4k-security-digest, Maven5.18.2.0OSV
- org.http4k:http4k-security-digest, Maven5.19.0.0OSV
- org.http4k:http4k-security-digest, Maven5.2.0.0OSV
- org.http4k:http4k-security-digest, Maven5.2.1.0OSV
- org.http4k:http4k-security-digest, Maven5.20.0.0OSV
- org.http4k:http4k-security-digest, Maven5.21.0.0OSV
- org.http4k:http4k-security-digest, Maven5.21.1.0OSV
- org.http4k:http4k-security-digest, Mavenfrom 4.0.0.0, fixed in 4.51.0.0OSV
- org.http4k:http4k-security-digest, Maven4.10.0.0.0OSV
- org.http4k:http4k-security-digest, Maven4.10.0.1OSV
- org.http4k:http4k-security-digest, Maven4.10.1.0OSV
- org.http4k:http4k-security-digest, Maven4.11.0.0OSV
- org.http4k:http4k-security-digest, Maven4.11.0.1OSV
- org.http4k:http4k-security-digest, Maven4.12.0.0OSV
- org.http4k:http4k-security-digest, Maven4.12.0.1OSV
- org.http4k:http4k-security-digest, Maven4.12.1.0OSV
- org.http4k:http4k-security-digest, Maven4.12.2.0OSV
- org.http4k:http4k-security-digest, Maven4.12.3.0OSV
- org.http4k:http4k-security-digest, Maven4.12.3.1OSV
- org.http4k:http4k-security-digest, Maven4.13.0.0OSV
- org.http4k:http4k-security-digest, Maven4.13.1.0OSV
- org.http4k:http4k-security-digest, Maven4.13.3.0OSV
- org.http4k:http4k-security-digest, Maven4.13.4.0OSV
- org.http4k:http4k-security-digest, Maven4.14.0.0OSV
- org.http4k:http4k-security-digest, Maven4.14.1.0OSV
- org.http4k:http4k-security-digest, Maven4.14.1.1OSV
- org.http4k:http4k-security-digest, Maven4.14.1.2OSV
- org.http4k:http4k-security-digest, Maven4.14.1.3OSV
- org.http4k:http4k-security-digest, Maven4.14.1.4OSV
- org.http4k:http4k-security-digest, Maven4.15.0.0OSV
- org.http4k:http4k-security-digest, Maven4.16.0.0OSV
- org.http4k:http4k-security-digest, Maven4.16.1.0OSV
- org.http4k:http4k-security-digest, Maven4.16.2.0OSV
- org.http4k:http4k-security-digest, Maven4.16.3.0OSV
- org.http4k:http4k-security-digest, Maven4.17.0.0OSV
- org.http4k:http4k-security-digest, Maven4.17.1.0OSV
- org.http4k:http4k-security-digest, Maven4.17.2.0OSV
- org.http4k:http4k-security-digest, Maven4.17.3.0OSV
- org.http4k:http4k-security-digest, Maven4.17.4.0OSV
- org.http4k:http4k-security-digest, Maven4.17.5.0OSV
- org.http4k:http4k-security-digest, Maven4.17.6.0OSV
- org.http4k:http4k-security-digest, Maven4.17.7.0OSV
- org.http4k:http4k-security-digest, Maven4.17.8.0OSV
- org.http4k:http4k-security-digest, Maven4.17.9.0OSV
- org.http4k:http4k-security-digest, Maven4.18.0.0OSV
- org.http4k:http4k-security-digest, Maven4.19.0.0OSV
- org.http4k:http4k-security-digest, Maven4.19.1.0OSV
- org.http4k:http4k-security-digest, Maven4.19.2.0OSV
- org.http4k:http4k-security-digest, Maven4.19.3.0OSV
- org.http4k:http4k-security-digest, Maven4.19.4.0OSV
- org.http4k:http4k-security-digest, Maven4.19.5.0OSV
- org.http4k:http4k-security-digest, Maven4.20.0.0OSV
- org.http4k:http4k-security-digest, Maven4.20.1.0OSV
- org.http4k:http4k-security-digest, Maven4.20.2.0OSV
- org.http4k:http4k-security-digest, Maven4.21.0.0OSV
- org.http4k:http4k-security-digest, Maven4.21.1.0OSV
- org.http4k:http4k-security-digest, Maven4.21.1.1OSV
- org.http4k:http4k-security-digest, Maven4.22.0.0OSV
References 7
- github.com/http4k/http4k/commit/725f1b9697Fixvia GitHub
- github.com/http4k/http4k/releases/tag/6.50.0.0Fixvia CVE List
- github.com/http4k/http4k/commit/725f1b96978dd433348e2b149c1e72b9f5147c90Fixvia CVE List
- github.com/http4k/http4k/security/advisories/GHSA-p28p-j94q-pg32Advisoryvia CVE List
- github.com/github/advisory-database/pull/9477Advisoryvia CVE List
- github.com/advisories/GHSA-p28p-j94q-pg32Advisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-54148Referencevia GitHub