CVE-2026-69206— Http4s: DigestAuth allows replay of captured requests
Quick assessment
Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Http4s 是用于 HTTP 服务的 Scala 接口。在 0.23.35 和 1.0.0-M47 之前，DigestAuth 的重放防护机制记录的是最后一个 nonce-count（nc）加一，而不是其实际接收到的最高 nc 值。当合法客户端由于并行或重试请求发送非连续的 nc 值时，存储的计数器仍低于已接收的最大值，这使得被动观察者可以多次重放捕获到的 Authorization 请求头。成功的重放会以被捕获用户的身份执行经过身份验证的请求，包括状态变更操作。该问题已在版本 0.23.35 和 1.0.0-M
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69206
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Http4s: DigestAuth allows replay of captured requests
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69206
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69206
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69206 (1)
Vendor Advisories for CVE-2026-69206 (1)
Vendor Pages for CVE-2026-69206 (2)
Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total
| CVE-2026-69204 | 9.2 CRITICAL | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl |
| CVE-2026-69217 | 8.7 HIGH | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69205 | 8.7 HIGH | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-69208 | 7.5 HIGH | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-88975 | 7.5 HIGH | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME |
| CVE-2026-69202 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69210 | 7.5 HIGH | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69213 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69203 | 7.5 HIGH | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69209 | 7.5 HIGH | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69214 | 6.8 MEDIUM | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69215 | 6.8 MEDIUM | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69201 | 5.9 MEDIUM | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69212 | 5.9 MEDIUM | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redire |
| CVE-2026-69216 | 5.4 MEDIUM | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | 4.8 MEDIUM | Http4s: Set-Cookie rendering does not escape attribute delimiters |
IV. Related Vulnerabilities
Same product: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN -
CVE-2026-69217
Http4s: Ember Server accepts duplicate Content-Length header
Same vendor: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN -
CVE-2026-69217
Http4s: Ember Server accepts duplicate Content-Length header
Same weakness: CWE-294
-
CVE-2026-88278
GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay -
CVE-2026-55250
Maravel-Framework Token Replay Vulnerability via Premature J -
CVE-2026-84003
Microsoft Authentication Library (MSAL) for Node.js Spoofing -
CVE-2026-69676
Windows Kerberos Remote Code Execution Vulnerability -
CVE-2026-73312
XenForo < 2.3.13 Refresh Token Replay via Expired Access Tok
V. Comments for CVE-2026-69206
No comments yet