Live › vulnerability › CVE-2026-120317
http4k's DigestEncoder computes the auth-int digest without hashing the request body, so the signed Authorization header still validates after the body is changed. An on-path attacker on a non-TLS connection can rewrite authenticated requests and trigger state-changing actions as the victim.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Only applications that use http4k's digest authentication client with the auth-int option are exposed, and only when requests go over a non-TLS channel an attacker can sit on. Services that talk only over TLS, or that do not use digest auth, can skip it. Affected projects are those pinned to versions from 4.9.10.0 up to but not including 6.60.0.0.
No product ranges from the sources yet.
http4k-core in build.gradle or pom.xml, and note its version.4.9.10.0 before 6.60.0.0: move to or later.6.60.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
This page as .md · .json · in your agent: get_signal("CVE-2026-120317")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.