# CVE-2026-120317: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- http4k / http4k (org.http4k/http4k-security-digest): ≥ 4.9.10.0; < 6.60.0.0 (affected, custom); 6.60.0.0 (unaffected, custom). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 8.2 (high); CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-345

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf (CNA: VulnCheck; vendor-advisory)

- https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-120317; retrieved 2026-11-02; source updated 2026-11-02

Revision: cfd3909bc3fcb91b66aa59a5a342edb4c506b25cbbd0575982080a3e7eab52d3

Canonical: https://y2.dev/cve/CVE-2026-120317