CVE-2026-100834

Name of the Vulnerable Software and Affected Versions org.http4k:http4k-security-digest versions prior to 6.48.0.0 org.http4k:http4k-security-digest versions prior to 5.42.0.0 org.http4k:http4k-security-digest versions prior to 4.51.0.0

Description The Digest authentication module defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }. This configuration causes the system to accept every nonce regardless of its value, age, or prior use, resulting in a lack of replay protection. An attacker who captures a valid 'Authorization: Digest' response via network traffic or logs can replay it indefinitely to access the protected resource.

Recommendations Update org.http4k:http4k-security-digest to version 6.48.0.0 or later. Update org.http4k:http4k-security-digest to version 5.42.0.0 or later. Update org.http4k:http4k-security-digest to version 4.51.0.0 or later.