CVE-2026-100834
1 advisory.
Maven/org.http4k:http4k-security-digest CVE-2026-100834: medium, EPSS 0.32%
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Action: Upgrade org.http4k:http4k-security-digest to 4.51.0.0 (4.x), 5.42.0.0 (5.x) or 6.48.0.0 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0.0 | 6.48.0.0 | - |
| 5.0.0.0 | 5.42.0.0 | - |
| 0 | 4.51.0.0 | - |
Fixed versions
| 6.48.0.0 | 5.42.0.0 | 4.51.0.0 |
Sources
- osv: GHSA-c7jm-38gq-h67h
- https://github.com/http4k/http4k/security/advisories/GHSA-c7jm-38gq-h67h
- https://github.com/http4k/http4k/commit/4f904b4692
- https://github.com/http4k/http4k/commit/8a52b615b1
- https://datatracker.ietf.org/doc/html/rfc7616#section-3.4
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/releases/tag/6.48.0.0
CVE-2026-100834 · published · modified · JSON