CVE Feed

    Dashboard / CVE / CVE-2026-120317

    CVE-2026-120317

    http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

    Published:Nov 2, 2026
    Last Modified:Nov 2, 2026
    EPS:Nov 2, 2026
    EPSS Score:
    CVSS Score:5.9

    Affected Products

    Vendor
    Http4k
    Product
    Http4k

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-120316 (CVSS 8.2) — http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload …
    CVE-2026-100834 (CVSS 8.2) — http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 a…
    CVE-2026-100725 (CVSS 8.3) — http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStor…
    CVE-2026-100724 (CVSS 6.3) — http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains)…
    CVE-2026-54147 (CVSS 6.5) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, Digest…
    CVE-2026-54148 (CVSS 8.1) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, Digest…
    CVE-2026-53659 (CVSS 7.5) — http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, Server…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High