Read the docs
TI-2026-83683 Aliases CVE-2026-120317GHSA-65gw-vqgg-jvcf

Missing body integrity check in http4k Digest auth-int

Priority HIGH 69CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

http4k from 4.9.10.0 before 6.60.0.0 lacks an integrity check in its Digest authentication, because DigestEncoder computes the auth-int digest without hashing the request entity body. An on-path attacker on a non-TLS channel can rewrite the body of an authenticated request while the Authorization header stays valid, which executes state-changing actions as the victim.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00122 2nd percentileScored 2026-11-07
Fix Fixed http4k (http4k): 6.60.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
http4khttp4k4.9.10.0 to before 6.60.0.06.60.0.0Patch availableCNA
  • http4k Vendorhttp4k Affected 4.9.10.0 to before 6.60.0.0 Fixed in 6.60.0.0 Patch available CNA

Remediation

Update http4k to 6.60.0.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA http4k (http4k) Fixed in 6.60.0.0

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120317
  2. 2026-11-02 Alias added: GHSA-65gw-vqgg-jvcf
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: MEDIUM → HIGH

References

Advisory 1

  • TI-2024-36944 http4k has a potential XXE (XML External Entity Injection) vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-38700 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS CVSS 3.1HIGH 7.5
  • TI-2026-39062 http4k: `DigestAuthProvider.verify` did not bind to request URI CVSS 3.1HIGH 8.1
  • TI-2026-64972 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass CVSS 4.0HIGH 8.2
  • TI-2026-64881 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage CVSS 4.0HIGH 8.3
  • TI-2026-83682 Path traversal in http4k ThymeleafTemplates lets attackers read files CVSS 4.0HIGH 8.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences