EUVD-2026-79236
GHSA-9xww-74xv-gjfp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 maven packages depend on org.http4s:http4s-ember-core_2.12 (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 0.23.35.
DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
DigestAuth replay protection in http4s mishandles the nonce-count it stores, so the server's counter can lag behind the highest value it has actually accepted; a passive network observer who captures one legitimate Digest Authorization header can therefore replay it repeatedly before the counter catches up. Successful replays are executed as the captured user and include state-changing requests, defeating the replay resistance that Digest authentication is supposed to provide over Basic auth. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today