Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-69208

Http4s: DigestAuth nonce map grows unbounded

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-69208

Published

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-69208

Published

http4s

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "http4s",
                    "product": "http4s",
                    "versions": [
                        {
                            "version": "< 0.23.35",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0-M1, < 1.0.0-M47",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON