CVE-2026-69206

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47

Description DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values due to parallel or retried requests, the stored counter remains below the accepted maximum. This allows a passive observer to replay a captured Authorization header multiple times to execute authenticated requests, including state-changing operations, as the captured user. This defeats the core replay protection that Digest authentication provides over Basic authentication.

Recommendations Update to version 0.23.35. Update to version 1.0.0-M47. Deploy the application over TLS to prevent requests from being captured.