EUVD-2026-79289
GHSA-fm4g-76c9-7w69
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in NonceKeeper causes fresh nonces to be discarded while eviction halts at the first stale entry, so the nonce map grows without bound. Any application that protects at least one route with DigestAuth and runs a version prior to 0.23.35 or 1.0.0-M47 is affected, and an unauthenticated remote attacker can drive repeated 401 authentication challenges until the JVM throws OutOfMemoryError and the service collapses. CVSS 7.5 (network, no privileges, no user interaction, availability-only) makes this a straightforward resource-exhaustion attack; no public exploit code or CISA KEV entry was identified at time of analysis, but exploitation requires nothing more than a loop of unauthenticated HTTP requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Http4S gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption), with CWE-401 (Missing Release of Memory after Effective Lifetime) as the secondary mapping in the advisory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 a
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploita
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access c
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote atta
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensiti
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely expl
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a singl
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
Exploit-DB