CVE-2026-69208

Received Received - Intake

Heap Exhaustion via DigestAuth Nonce Handling in Http4s

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-69208

EUVD

EUVD-2026-79289

Affected Vendors & Products

Vendor	Product	Version / Range
http4s	http4s	to 0.23.35 (exc)
http4s	http4s	to 1.0.0-M47 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability affects the DigestAuth server middleware in the http4s library. Due to an inverted comparison in the nonce cleanup logic, fresh nonces are removed while stale ones are retained. This causes the nonce map to grow unbounded, leading to heap exhaustion and a denial-of-service condition.

Detection Guidance

Monitor for excessive memory usage in Java processes running http4s applications. Check for repeated DigestAuth authentication challenges in server logs. Use tools like jstack or VisualVM to inspect heap usage and identify unbounded nonce cache growth.

Impact Analysis

An unauthenticated attacker can repeatedly trigger authentication challenges, causing the nonce map to grow until the JVM runs out of memory. This results in a denial-of-service where the application becomes unresponsive or crashes.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service (DoS) attacks that disrupt service availability. GDPR requires maintaining service availability, and HIPAA mandates timely access to protected health information. An attacker exploiting this flaw could cause system outages, potentially violating these requirements.

Mitigation Strategies

Upgrade http4s to version 0.23.35 or 1.0.0-M47 or later. Implement rate limiting on authentication endpoints. Restart services periodically to clear nonce caches. Monitor memory usage and set alerts for abnormal growth.

Hi! I’m here to help you understand CVE-2026-69208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70