CVE-2026-120317

MEDIUM 5.9

http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

CWE	CWE-345
Vendor	http4k
Product	http4k
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for http4k http4k

Be the first to know when new medium vulnerabilities affecting http4k http4k are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

http4k / http4k

4.9.10.0 < 6.60.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf vulncheck.com: https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity

Credits

🔍 manus-pi 🔍 manus-use