CVE-2026-54147
1 advisory.
Maven/org.http4k:http4k-security-digest CVE-2026-54147: medium 6.5
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Action: Upgrade org.http4k:http4k-security-digest to 5.42.0.0 (5.x) or 6.50.0.0 (6.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0.0 | 6.50.0.0 | - |
| 5.0.0.0 | 5.42.0.0 | - |
| 0 | - | 4.48.2.0 |
Fixed versions
| 6.50.0.0 | 5.42.0.0 |
Sources
- osv: GHSA-vxxm-wwqh-mh47
- https://github.com/http4k/http4k/security/advisories/GHSA-vxxm-wwqh-mh47
- https://github.com/http4k/http4k/commit/65d23d99fc
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/releases/tag/6.50.0.0
CVE-2026-54147 · published · modified · JSON