CVE-2026-69208
Http4s: DigestAuth nonce map grows unbounded
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
| CWE | CWE-400 CWE-401 |
| Vendor | http4s |
| Product | http4s |
| Published | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for http4s http4s
Be the first to know when new high vulnerabilities affecting http4s http4s are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
http4s / http4s
< 0.23.35 >= 1.0.0-M1, < 1.0.0-M47
References
github.com: https://github.com/http4s/http4s/security/advisories/GHSA-fm4g-76c9-7w69 github.com: https://github.com/http4s/http4s/commit/8cfeda8472954d631dfbe5dc026463a27653e482 github.com: https://github.com/http4s/http4s/releases/tag/v0.23.35 github.com: https://github.com/http4s/http4s/releases/tag/v1.0.0-M47