CVE-2026-69206

Received Received - Intake

Digest Auth Replay in Http4s

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-69206

EUVD

EUVD-2026-79236

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

CVE-2026-69206 is a vulnerability in the Http4s library's DigestAuth implementation. It allows attackers to replay captured Digest-authenticated requests by exploiting incorrect storage of nonce-count values. Instead of tracking the highest accepted nonce-count, the server stores lastNc plus one, causing the counter to lag behind legitimate requests. This enables passive observers to reuse a single Authorization header for multiple authenticated requests.

Detection Guidance

To detect this vulnerability, check if your http4s application uses DigestAuth and is running a vulnerable version (before 0.23.35 or 1.0.0-M47). Inspect server logs for repeated Authorization headers with the same nonce-count values. Use network monitoring tools to capture and analyze Digest-authenticated requests for replay patterns.

Impact Analysis

If you use affected versions of Http4s, an attacker could capture a single authenticated request and replay it multiple times to perform state-changing operations as the legitimate user. This includes actions like modifying data or triggering unauthorized processes. The impact depends on the application's functionality and user privileges.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized replay of authenticated requests. If exploited, it may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations. The replay attack could enable attackers to execute state-changing operations or access protected resources as legitimate users.

Mitigation Strategies

Upgrade http4s to version 0.23.35 or later for Scala 2.12/2.13/3 branches. If upgrading is not immediately possible, deploy the application over TLS to prevent passive capture of Authorization headers. Monitor network traffic for Digest-auth replay attempts as a temporary measure.

Hi! I’m here to help you understand CVE-2026-69206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70