CVE-2026-120317highCWE-345

CVE-2026-120317: falha de alta gravidade em http4k

http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Publicada em

Seguir esta CVE+ Monitorar http4k

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.1%
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
http4k · http4k
CVEs relacionadas — http4k

No mesmo produto, das mais perigosas para as menos.

CVE-2024-55875CRITICALhttp4k has a potential XXE (XML External Entity Injection) vulnerabilityEPSS 1.9%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.6%CVE-2026-54148HIGHhttp4k: `DigestAuthProvider.verify` did not bind to request URIEPSS 0.6%CVE-2026-100724MEDIUMhttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyEPSS 0.3%CVE-2026-100834HIGHhttp4k before 6.48.0.0 Digest Authentication Replay Protection BypassEPSS 0.3%CVE-2026-120316HIGHhttp4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template ResolutionEPSS 0.3%