{"id":"CVE-2026-120317","kind":"vulnerability","aliases":["CVE-2026-120317"],"related":[],"title":"http4k: digest auth skips request body, letting on-path attackers alter requests","description":"http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.","summary":"http4k's DigestEncoder computes the auth-int digest without hashing the request body, so the signed Authorization header still validates after the body is changed. An on-path attacker on a non-TLS connection can rewrite authenticated requests and trigger state-changing actions as the victim.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["digest-auth","http4k","jvm","kotlin","package"],"not_affected_if":["default-config","no-digest-auth","tls-only"],"how_to_check":"- Look for the http4k dependency in build files, for example `http4k-core` in `build.gradle` or `pom.xml`, and note its version.\n- Confirm whether any client uses digest authentication with the auth-int quality of protection.\n- Check whether those requests travel over plain HTTP.","fix":"- http4k from `4.9.10.0` before `6.60.0.0`: move to `6.60.0.0` or later.","status":"open","published_at":"2026-11-02T03:17:29+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","triaged_at":"2026-11-02T03:31:50+00:00","updated_at":"2026-11-02T03:31:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T03:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- http4k from `4.9.10.0` before `6.60.0.0`: move to `6.60.0.0` or later.","reach":"network","title":"http4k: digest auth skips request body, letting on-path attackers alter requests","impact":"high","summary":"http4k's DigestEncoder computes the auth-int digest without hashing the request body, so the signed Authorization header still validates after the body is changed. An on-path attacker on a non-TLS connection can rewrite authenticated requests and trigger state-changing actions as the victim.","audience":"developers","category":"package","nicknames":[],"who_cares":["http4k","kotlin","jvm","digest-auth"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker rewrites request bodies, triggering actions as the authenticated user","analyst_note":"","how_to_check":"- Look for the http4k dependency in build files, for example `http4k-core` in `build.gradle` or `pom.xml`, and note its version.\n- Confirm whether any client uses digest authentication with the auth-int quality of protection.\n- Check whether those requests travel over plain HTTP.","plain_action":"","needs_analyst":false,"not_affected_if":["tls-only","no-digest-auth","default-config"],"who_is_affected":"Only applications that use http4k's digest authentication client with the auth-int option are exposed, and only when requests go over a non-TLS channel an attacker can sit on. Services that talk only over TLS, or that do not use digest auth, can skip it. Affected projects are those pinned to versions from 4.9.10.0 up to but not including 6.60.0.0.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4153,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120317':16A,19A '-2026':15A,18A '4.9.10.0':79C '6.60.0.0':81C 'action':73B,128C 'alter':12A 'attack':11A,57B,105C 'auth':3A,22B,33B,93C 'auth-int':32B,92C 'authent':66B,116C 'author':44B,121C 'bodi':6A,40B,50B,101C,114C 'chang':52B,72B,127C 'channel':110C 'check':86C 'comput':30B,90C 'connect':63B 'contain':82C 'cve':14A,17A 'digest':2A,21B,35B,95C 'digest-auth':20B 'digestencod':29B,89C 'entiti':100C 'execut':124C 'hash':37B,97C 'header':45B,122C 'http4k':1A,23B,27B,77C 'int':34B,94C 'integr':85C 'jvm':24B 'keep':119C 'kotlin':25B 'let':7A 'miss':84C 'non':61B,108C 'non-tl':60B,107C 'on-path':8A,54B,102C 'packag':26B 'path':10A,56B,104C 'request':5A,13A,39B,67B,99C,117C 'rewrit':65B,112C 'sign':43B 'skip':4A 'state':71B,126C 'state-chang':70B,125C 'still':46B 'tls':62B,109C 'trigger':69B 'valid':47B,123C 'victim':76B,131C 'vulner':87C 'without':36B,96C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use http4k's digest authentication client with the auth-int option are exposed, and only when requests go over a non-TLS channel an attacker can sit on. Services that talk only over TLS, or that do not use digest auth, can skip it. Affected projects are those pinned to versions from 4.9.10.0 up to but not including 6.60.0.0.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["digestauth","high","http4k","jvm","kotlin","package"],"first_public_at":"2026-11-02T03:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120317","severity":null,"published_at":"2026-11-02T03:17:29+00:00","modified_at":"2026-11-02T03:17:30+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","fetched_at":"2026-11-02T03:31:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}