CVE-2026-120317
Deferred Deferred - Pending Action

http4k DigestEncoder Missing Integrity Check Vulnerability

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
http4k http4k 4.9.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120317 is a missing integrity check vulnerability in http4k's Digest authentication implementation. The auth-int mode, meant to protect request body integrity per RFC 7616, fails because the DigestEncoder computes the digest without hashing the entity body. This allows on-path attackers on non-TLS channels to modify request bodies while keeping the Authorization header valid, enabling unauthorized state changes.

Detection Guidance

To detect this vulnerability, check if your http4k application uses Digest authentication with auth-int QoP in versions between 4.9.10.0 and 6.59.0.0. Inspect server logs for requests using Digest auth-int and verify if the request body is included in the HA2 hash computation. Use network monitoring tools to detect unauthorized modifications to request bodies on non-TLS channels.

Impact Analysis

Attackers could alter sensitive data in authenticated requests, such as financial transactions, without detection. Since the server accepts modified requests as valid, victims may unknowingly execute unintended actions. The impact depends on the application's use of Digest auth-int and whether TLS is used for transport.

Compliance Impact

This vulnerability could violate integrity requirements in GDPR (data accuracy) and HIPAA (secure data transmission). Non-compliance may occur if organizations rely on Digest auth-int for integrity without TLS, as attackers can tamper with data undetected. Regulatory penalties may apply if sensitive data is compromised.

Mitigation Strategies

Immediately upgrade http4k to version 6.60.0.0 or later. If upgrading is not possible, disable auth-int QoP and use Auth instead. Ensure all authenticated requests are transmitted over TLS to prevent on-path attackers from modifying request bodies. Monitor network traffic for suspicious modifications to authenticated requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...