CVE-2026-100834
Description
http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.
How to fix
- org.http4k:http4k-security-digest6.48.0.0, 5.42.0.0, 4.51.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.http4k:http4k-security-digestMaven | 6.0.0.0 ≤ v < 6.48.0.0, 5.0.0.0 ≤ v < 5.42.0.0, v < 4.51.0.0 | 6.48.0.0, 5.42.0.0, 4.51.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.