CVE-2026-120317— http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Quick assessment

Affected

http4k http4k

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

http4k 版本从 4.9.10.0 到 6.60.0.0 之前存在一个完整性检查缺失的漏洞。由于 DigestEncoder 在计算 auth-int 摘要时未对请求实体主体进行哈希处理，非 TLS 通道上的中间路径攻击者可以篡改已认证请求的主体内容，同时保持 Authorization 请求头有效，从而以受害者的身份执行状态变更操作。

CVSS 5.9 · Medium Updated Nov 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Source: CVE Program / CVE List V5

Vulnerability Description

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
http4k	http4k	4.9.10.0 ~ 6.60.0.0	-

II. Public POCs for CVE-2026-120317

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120317

请登录查看更多情报信息。

Other References for CVE-2026-120317 (2)

https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf vendor-advisory
https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120317

IV. Related Vulnerabilities

Same product: http4k

Same vendor: http4k

Same weakness: CWE-345