Public vulnerability disclosure
CVE-2026-120317
http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity
publishedCWE-345
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
Technical severity8.2 highCVSS 4.0 · CNA: VulnCheck
Published2026-11-02Source updated 2026-11-02
Collected2026-11-021 attributed source
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| http4k http4k org.http4k/http4k-security-digest
maven |
≥ 4.9.10.0; < 6.60.0.0 (affected, custom) 6.60.0.0 (unaffected, custom) Other versions: unaffected |
CNA: VulnCheck |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 8.2 high |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | CNA: VulnCheck |
| 3.1 / 5.9 medium |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | CNA: VulnCheck |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcfCNA: VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrityCNA: VulnCheck · third-party-advisory