Skip to content
OpenAdvisories

Package · Maven

org.http4k:http4k-security-digest

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-100834

    http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

    http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardles…

    http4k http4k org.http4k:http4k-security-digest Maven
  • Medium 6.5
    CVE-2026-54147

    http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

    http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deplo…

    http4k http4k org.http4k:http4k-security-digest Maven