Vulnerability GHSA-c7jm-38gq-h67h
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 19, 2026 at 09:16 PM UTC
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
v6.3.0.0 - v6.4.1.0
v6.3.0.0 - v6.4.1.0
Summary
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Details
Impact
ServerFilters.DigestAuth and the underlying DigestAuthProvider both defaulted their nonceVerifier parameter to { true } — i.e. every nonce was accepted regardless of value, age, or prior use. Any deployment using the default configuration had no replay protection on Digest authentication; a captured Authorization: Digest … response could be replayed indefinitely against the same protected resource.
The nonce-verification mechanism in Digest auth is the primary anti-replay control — without it, Digest reduces to a credential bound only to a stale nonce string.
Who is affected: any application using ServerFilters.DigestAuth or DigestAuthProvider with the default nonceVerifier. The broken default has been present since DigestAuthProvider was introduced (2021). Exploitation requires the attacker to first capture a valid Digest response (network observation, log access, etc.) — non-trivial in modern TLS deployments but not impossible. Anyone running Digest auth with default config should treat upgrade as urgent.
Patches
| Line | Fixed in | Edition |
|---|---|---|
| v6.x (Community) | 6.48.0.0 | Community |
| v5.x (LTS) | 5.42.0.0 | Enterprise — contact [email protected] (if Digest auth is present in your v5.x line) |
| v4.x (LTS) | 4.51.0.0 | Enterprise — contact [email protected] (if Digest auth is present in your v4.x line) |
The fix ([Break]) removes the default value for nonceVerifier from both ServerFilters.DigestAuth and DigestAuthProvider. Callers must now supply a real verifier explicitly — the broken default cannot be silently inherited.
Workarounds
For deployments that cannot upgrade immediately: explicitly supply a nonceVerifier that tracks issued nonces, enforces a TTL, and rejects re-use. Do not rely on the default.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 month ago
http4k: `DigestAuthProvider.verify` did not bind to request URI
==4.10.0.0.0, ==4.10.0.1, ==4.10.1.0, ==4.11.0.0, ==4.11.0.1, ==4.12.0.0, ==4.12.0.1, ==4.12.1.0, ==4.12.2.0, ==4.12.3.0, ==4.12.3.1, ==4.13.0.0, ==4.13.1.0, ==4.13.3.0, ==4.13.4.0, ==4.14.0.0, ==4.14.1.0, ==4.14.1.1, ==4.14.1.2, ==4.14.1.3, ==4.14.1.4, ==4.15.0.0, ==4.16.0.0, ==4.16.1.0, ==4.16.2.0, ==4.16.3.0, ==4.17.0.0, ==4.17.1.0, ==4.17.2.0, ==4.17.3.0, ==4.17.4.0, ==4.17.5.0, ==4.17.6.0, ==4.17.7.0, ==4.17.8.0, ==4.17.9.0, ==4.18.0.0, ==4.19.0.0, ==4.19.1.0, ==4.19.2.0, ==4.19.3.0, ==4.19.4.0, ==4.19.5.0, ==4.20.0.0, ==4.20.1.0, ==4.20.2.0, ==4.21.0.0, ==4.21.1.0, ==4.21.1.1, ==4.22.0.0, ==4.22.0.1, ==4.23.0.0, ==4.24.0.0, ==4.25.0.0, ==4.25.1.0, ==4.25.10.0, ==4.25.10.1, ==4.25.11.0, ==4.25.12.0, ==4.25.13.0, ==4.25.14.0, ==4.25.15.0, ==4.25.16.0, ==4.25.16.1, ==4.25.16.2, ==4.25.2.0, ==4.25.3.0, ==4.25.4.0, ==4.25.4.1, ==4.25.5.0, ==4.25.5.1, ==4.25.5.2, ==4.25.6.0, ==4.25.7.0, ==4.25.8.0, ==4.25.9.0, ==4.26.0.0, ==4.27.0.0, ==4.27.1.0, ==4.27.2.0, ==4.27.3.0, ==4.27.4.0, ==4.28.0.0, ==4.28.1.0, ==4.28.2.0, ==4.29.0.0, ==4.29.1.0, ==4.30.0.0, ==4.30.10.0, ==4.30.2.0, ==4.30.2.1, ==4.30.3.0, ==4.30.4.0, ==4.30.5.0, ==4.30.6.0, ==4.30.7.0, ==4.30.8.0, ==4.30.9.0, ==4.31.0.0, ==4.32.0.0, ==4.32.1.0, ==4.32.2.0, ==4.32.3.0, ==4.32.4.0, ==4.33.0.0, ==4.33.1.0, ==4.33.2.0, ==4.33.2.1, ==4.33.3.0, ==4.34.0.0, ==4.34.0.1, ==4.34.0.2, ==4.34.0.3, ==4.34.0.4, ==4.34.1.0, ==4.34.2.0, ==4.34.3.0, ==4.34.3.1, ==4.34.4.0, ==4.35.0.0, ==4.35.1.0, ==4.35.2.0, ==4.35.3.0, ==4.35.4.0, ==4.36.0.0, ==4.37.0.0, ==4.38.0.0, ==4.38.0.1, ==4.39.0.0, ==4.40.0.0, ==4.40.1.0, ==4.40.2.0, ==4.41.0.0, ==4.41.1.0, ==4.41.1.1, ==4.41.2.0, ==4.41.3.0, ==4.41.4.0, ==4.42.0.0, ==4.42.1.0, ==4.43.0.0, ==4.43.1.0, ==4.44.0.0, ==4.44.1.0, ==4.45.0.0, ==4.46.0.0, ==4.47.1.0, ==4.47.2.0, ==4.48.0.0, ==4.48.2.0, ==4.9.10.0, ==5.0.0.0, ==5.1.0.0, ==5.1.1.0, ==5.1.1.1, ==5.1.2.0, ==5.1.2.1, ==5.10.0.0, ==5.10.1.0, ==5.10.2.0, ==5.10.3.0, ==5.10.4.0, ==5.10.5.0, ==5.10.6.0, ==5.10.7.0, ==5.11.0.0, ==5.11.1.0, ==5.12.0.0, ==5.12.1.0, ==5.12.2.0, ==5.12.2.1, ==5.13.0.0, ==5.13.0.1, ==5.13.1.0, ==5.13.2.0, ==5.13.4.0, ==5.13.4.1, ==5.13.5.0, ==5.13.6.0, ==5.13.6.1, ==5.13.7.0, ==5.13.8.0, ==5.13.9.0, ==5.14.0.0, ==5.14.1.0, ==5.14.2.0, ==5.14.4.0, ==5.14.5.0, ==5.15.0.0, ==5.16.0.0, ==5.16.1.0, ==5.16.2.0, ==5.17.0.0, ==5.18.1.0, ==5.18.2.0, ==5.19.0.0, ==5.2.0.0, ==5.2.1.0, ==5.20.0.0, ==5.21.0.0, ==5.21.1.0, ==5.21.2.0, ==5.22.0.0, ==5.23.0.0, ==5.24.0.0, ==5.24.1.0, ==5.25.0.0, ==5.26.0.0, ==5.26.1.0, ==5.27.0.0, ==5.28.0.0, ==5.28.1.0, ==5.29.0.0, ==5.3.0.0, ==5.30.0.0, ==5.30.1.0, ==5.31.0.0, ==5.31.1.0, ==5.32.0.0, ==5.32.1.0, ==5.32.2.0, ==5.32.3.0, ==5.32.4.0, ==5.33.0.0, ==5.33.0.1, ==5.33.1.0, ==5.34.0.0, ==5.34.1.0, ==5.35.0.0, ==5.35.1.0, ==5.35.2.0, ==5.35.3.0, ==5.35.4.0, ==5.35.5.0, ==5.36.0.0, ==5.37.0.0, ==5.37.1.0, ==5.37.1.1, ==5.38.0.0, ==5.39.0.0, ==5.4.0.0, ==5.4.1.0, ==5.40.0.0, ==5.41.0.0, ==5.5.0.0, ==5.6.0.0, ==5.6.1.0, ==5.6.2.0, ==5.6.2.1, ==5.6.3.0, ==5.6.4.0, ==5.6.5.0, ==5.7.1.0, ==5.7.2.0, ==5.7.3.0, ==5.7.4.0, ==5.7.5.0, ==5.8.0.0, ==5.8.1.0, ==5.8.2.0, ==5.8.3.0, ==5.8.4.0, ==5.8.5.0, ==5.8.5.1, ==5.8.6.0, ==5.9.0.0, ==6.0.0.0, ==6.0.1.0, ==6.1.0.0, ==6.1.0.1, ==6.10.0.0, ==6.10.1.0, ==6.10.2.0, ==6.11.0.0, ==6.11.1.0, ==6.12.0.0, ==6.13.0.0, ==6.14.0.0, ==6.15.0.0, ==6.15.0.1, ==6.15.1.0, ==6.16.0.0, ==6.17.0.0, ==6.18.0.1, ==6.18.1.0, ==6.19.0.0, ==6.2.0.0, ==6.20.0.0, ==6.20.0.1, ==6.20.0.2, ==6.20.0.3, ==6.20.1.0, ==6.20.2.0, ==6.20.2.1, ==6.21.0.0, ==6.21.1.0, ==6.22.0.0, ==6.23.0.0, ==6.23.1.0, ==6.24.0.0, ==6.24.1.0, ==6.25.0.0, ==6.25.1.0, ==6.26.0.0, ==6.26.1.0, ==6.27.0.0, ==6.28.0.0, ==6.28.1.0, ==6.29.0.0, ==6.30.0.0, ==6.30.1.0, ==6.31.0.0, ==6.31.1.0, ==6.32.0.0, ==6.33.0.0, ==6.34.0.0, ==6.35.0.0, ==6.36.0.0, ==6.37.0.0, ==6.38.0.0, ==6.39.0.0, ==6.39.1.0, ==6.4.0.0, ==6.4.1.0, ==6.40.0.0, ==6.40.1.0, ==6.41.0.0, ==6.42.0.0, ==6.43.0.0, ==6.44.0.0, ==6.45.0.0, ==6.45.1.0, ==6.46.0.0, ==6.46.1.0, ==6.47.0.0, ==6.47.1.0, ==6.47.2.0, ==6.48.0.0, ==6.49.0.0, ==6.5.0.0, ==6.5.1.0, ==6.5.2.0, ==6.5.3.0, ==6.5.4.0, ==6.5.5.0, ==6.5.5.1, ==6.5.6.0, ==6.5.6.1, ==6.6.0.0, ==6.6.0.1, ==6.6.1.0, ==6.7.0.0, ==6.8.0.0, ==6.8.1.0, ==6.9.0.0, ==6.9.1.0, ==6.9.2.0 GHSA-p28p-j94q-pg32
==4.10.0.0.0, ==4.10.0.1, ==4.10.1.0, ==4.11.0.0, ==4.11.0.1, ==4.12.0.0, ==4.12.0.1, ==4.12.1.0, ==4.12.2.0, ==4.12.3.0, ==4.12.3.1, ==4.13.0.0, ==4.13.1.0, ==4.13.3.0, ==4.13.4.0, ==4.14.0.0, ==4.14.1.0, ==4.14.1.1, ==4.14.1.2, ==4.14.1.3, ==4.14.1.4, ==4.15.0.0, ==4.16.0.0, ==4.16.1.0, ==4.16.2.0, ==4.16.3.0, ==4.17.0.0, ==4.17.1.0, ==4.17.2.0, ==4.17.3.0, ==4.17.4.0, ==4.17.5.0, ==4.17.6.0, ==4.17.7.0, ==4.17.8.0, ==4.17.9.0, ==4.18.0.0, ==4.19.0.0, ==4.19.1.0, ==4.19.2.0, ==4.19.3.0, ==4.19.4.0, ==4.19.5.0, ==4.20.0.0, ==4.20.1.0, ==4.20.2.0, ==4.21.0.0, ==4.21.1.0, ==4.21.1.1, ==4.22.0.0, ==4.22.0.1, ==4.23.0.0, ==4.24.0.0, ==4.25.0.0, ==4.25.1.0, ==4.25.10.0, ==4.25.10.1, ==4.25.11.0, ==4.25.12.0, ==4.25.13.0, ==4.25.14.0, ==4.25.15.0, ==4.25.16.0, ==4.25.16.1, ==4.25.16.2, ==4.25.2.0, ==4.25.3.0, ==4.25.4.0, ==4.25.4.1, ==4.25.5.0, ==4.25.5.1, ==4.25.5.2, ==4.25.6.0, ==4.25.7.0, ==4.25.8.0, ==4.25.9.0, ==4.26.0.0, ==4.27.0.0, ==4.27.1.0, ==4.27.2.0, ==4.27.3.0, ==4.27.4.0, ==4.28.0.0, ==4.28.1.0, ==4.28.2.0, ==4.29.0.0, ==4.29.1.0, ==4.30.0.0, ==4.30.10.0, ==4.30.2.0, ==4.30.2.1, ==4.30.3.0, ==4.30.4.0, ==4.30.5.0, ==4.30.6.0, ==4.30.7.0, ==4.30.8.0, ==4.30.9.0, ==4.31.0.0, ==4.32.0.0, ==4.32.1.0, ==4.32.2.0, ==4.32.3.0, ==4.32.4.0, ==4.33.0.0, ==4.33.1.0, ==4.33.2.0, ==4.33.2.1, ==4.33.3.0, ==4.34.0.0, ==4.34.0.1, ==4.34.0.2, ==4.34.0.3, ==4.34.0.4, ==4.34.1.0, ==4.34.2.0, ==4.34.3.0, ==4.34.3.1, ==4.34.4.0, ==4.35.0.0, ==4.35.1.0, ==4.35.2.0, ==4.35.3.0, ==4.35.4.0, ==4.36.0.0, ==4.37.0.0, ==4.38.0.0, ==4.38.0.1, ==4.39.0.0, ==4.40.0.0, ==4.40.1.0, ==4.40.2.0, ==4.41.0.0, ==4.41.1.0, ==4.41.1.1, ==4.41.2.0, ==4.41.3.0, ==4.41.4.0, ==4.42.0.0, ==4.42.1.0, ==4.43.0.0, ==4.43.1.0, ==4.44.0.0, ==4.44.1.0, ==4.45.0.0, ==4.46.0.0, ==4.47.1.0, ==4.47.2.0, ==4.48.0.0, ==4.48.2.0, ==4.9.10.0, ==5.0.0.0, ==5.1.0.0, ==5.1.1.0, ==5.1.1.1, ==5.1.2.0, ==5.1.2.1, ==5.10.0.0, ==5.10.1.0, ==5.10.2.0, ==5.10.3.0, ==5.10.4.0, ==5.10.5.0, ==5.10.6.0, ==5.10.7.0, ==5.11.0.0, ==5.11.1.0, ==5.12.0.0, ==5.12.1.0, ==5.12.2.0, ==5.12.2.1, ==5.13.0.0, ==5.13.0.1, ==5.13.1.0, ==5.13.2.0, ==5.13.4.0, ==5.13.4.1, ==5.13.5.0, ==5.13.6.0, ==5.13.6.1, ==5.13.7.0, ==5.13.8.0, ==5.13.9.0, ==5.14.0.0, ==5.14.1.0, ==5.14.2.0, ==5.14.4.0, ==5.14.5.0, ==5.15.0.0, ==5.16.0.0, ==5.16.1.0, ==5.16.2.0, ==5.17.0.0, ==5.18.1.0, ==5.18.2.0, ==5.19.0.0, ==5.2.0.0, ==5.2.1.0, ==5.20.0.0, ==5.21.0.0, ==5.21.1.0, ==5.21.2.0, ==5.22.0.0, ==5.23.0.0, ==5.24.0.0, ==5.24.1.0, ==5.25.0.0, ==5.26.0.0, ==5.26.1.0, ==5.27.0.0, ==5.28.0.0, ==5.28.1.0, ==5.29.0.0, ==5.3.0.0, ==5.30.0.0, ==5.30.1.0, ==5.31.0.0, ==5.31.1.0, ==5.32.0.0, ==5.32.1.0, ==5.32.2.0, ==5.32.3.0, ==5.32.4.0, ==5.33.0.0, ==5.33.0.1, ==5.33.1.0, ==5.34.0.0, ==5.34.1.0, ==5.35.0.0, ==5.35.1.0, ==5.35.2.0, ==5.35.3.0, ==5.35.4.0, ==5.35.5.0, ==5.36.0.0, ==5.37.0.0, ==5.37.1.0, ==5.37.1.1, ==5.38.0.0, ==5.39.0.0, ==5.4.0.0, ==5.4.1.0, ==5.40.0.0, ==5.41.0.0, ==5.5.0.0, ==5.6.0.0, ==5.6.1.0, ==5.6.2.0, ==5.6.2.1, ==5.6.3.0, ==5.6.4.0, ==5.6.5.0, ==5.7.1.0, ==5.7.2.0, ==5.7.3.0, ==5.7.4.0, ==5.7.5.0, ==5.8.0.0, ==5.8.1.0, ==5.8.2.0, ==5.8.3.0, ==5.8.4.0, ==5.8.5.0, ==5.8.5.1, ==5.8.6.0, ==5.9.0.0, ==6.0.0.0, ==6.0.1.0, ==6.1.0.0, ==6.1.0.1, ==6.10.0.0, ==6.10.1.0, ==6.10.2.0, ==6.11.0.0, ==6.11.1.0, ==6.12.0.0, ==6.13.0.0, ==6.14.0.0, ==6.15.0.0, ==6.15.0.1, ==6.15.1.0, ==6.16.0.0, ==6.17.0.0, ==6.18.0.1, ==6.18.1.0, ==6.19.0.0, ==6.2.0.0, ==6.20.0.0, ==6.20.0.1, ==6.20.0.2, ==6.20.0.3, ==6.20.1.0, ==6.20.2.0, ==6.20.2.1, ==6.21.0.0, ==6.21.1.0, ==6.22.0.0, ==6.23.0.0, ==6.23.1.0, ==6.24.0.0, ==6.24.1.0, ==6.25.0.0, ==6.25.1.0, ==6.26.0.0, ==6.26.1.0, ==6.27.0.0, ==6.28.0.0, ==6.28.1.0, ==6.29.0.0, ==6.30.0.0, ==6.30.1.0, ==6.31.0.0, ==6.31.1.0, ==6.32.0.0, ==6.33.0.0, ==6.34.0.0, ==6.35.0.0, ==6.36.0.0, ==6.37.0.0, ==6.38.0.0, ==6.39.0.0, ==6.39.1.0, ==6.4.0.0, ==6.4.1.0, ==6.40.0.0, ==6.40.1.0, ==6.41.0.0, ==6.42.0.0, ==6.43.0.0, ==6.44.0.0, ==6.45.0.0, ==6.45.1.0, ==6.46.0.0, ==6.46.1.0, ==6.47.0.0, ==6.47.1.0, ==6.47.2.0, ==6.48.0.0, ==6.49.0.0, ==6.5.0.0, ==6.5.1.0, ==6.5.2.0, ==6.5.3.0, ==6.5.4.0, ==6.5.5.0, ==6.5.5.1, ==6.5.6.0, ==6.5.6.1, ==6.6.0.0, ==6.6.0.1, ==6.6.1.0, ==6.7.0.0, ==6.8.0.0, ==6.8.1.0, ==6.9.0.0, ==6.9.1.0, ==6.9.2.0 GHSA-p28p-j94q-pg32
Medium Risk
1 month ago
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
v6.3.0.0 - v6.4.1.0 GHSA-vxxm-wwqh-mh47
v6.3.0.0 - v6.4.1.0 GHSA-vxxm-wwqh-mh47
Impacted packages
Timeline
Published
3 months ago
June 19, 2026 at 09:16 PM UTC
Fixed (6.48.0.0)
Unknown
Unknown
Fixed (5.42.0.0)
Unknown
Unknown
Last Modified
1 day ago
September 27, 2026 at 11:56 AM UTC