CVE-2026-120317 Details
Description
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
A vulnerability in http4k versions 4.9.10.0 prior to 6.60.0.0 allows on-path attackers to manipulate the body of authenticated requests without invalidating the Authorization header. This issue arises because the DigestEncoder calculates the auth-int digest without including the request entity body, creating a missing integrity check. As a result, attackers can exploit this flaw on non-TLS channels to execute state-changing actions on behalf of the victim.
As an interim mitigation, operators should avoid relying on auth-int for integrity and instead use TLS to protect the transport layer. If TLS is not available, do not configure qop to include auth-int.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| http4k | >= 4.9.10.0, <= 6.59.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |