CVE-2026-69208— Http4s: DigestAuth nonce map grows unbounded
Quick assessment
Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Http4s 是用于 HTTP 服务的 Scala 接口。在 0.23.35 和 1.0.0-M47 版本之前，DigestAuth 服务器中间件在比较 nonce 是否过期时存在逻辑反转的缺陷，导致其移除“新鲜”（有效）nonce，并停止对过期 nonce 的清理。在至少有一个路由受到 DigestAuth 保护的应用程序中，未经身份验证的攻击者可以反复触发身份验证质询，导致持久化的 nonce 映射表持续增长，直至耗尽 JVM 堆内存。该问题已在版本 0.23.35 和 1.0.0-M47 中修复。
Possible ATT&CK Techniques 1 AI
T1595 · Active Scanning
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69208
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Http4s: DigestAuth nonce map grows unbounded
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69208
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69208
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69208 (1)
Vendor Advisories for CVE-2026-69208 (1)
Vendor Pages for CVE-2026-69208 (2)
Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total
| CVE-2026-69204 | 9.2 CRITICAL | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl |
| CVE-2026-69217 | 8.7 HIGH | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69205 | 8.7 HIGH | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-88975 | 7.5 HIGH | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME |
| CVE-2026-69202 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69210 | 7.5 HIGH | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69213 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69203 | 7.5 HIGH | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69209 | 7.5 HIGH | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69214 | 6.8 MEDIUM | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69215 | 6.8 MEDIUM | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69201 | 5.9 MEDIUM | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69212 | 5.9 MEDIUM | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redire |
| CVE-2026-69206 | 5.9 MEDIUM | Http4s: DigestAuth allows replay of captured requests |
| CVE-2026-69216 | 5.4 MEDIUM | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | 4.8 MEDIUM | Http4s: Set-Cookie rendering does not escape attribute delimiters |
IV. Related Vulnerabilities
Same product: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same vendor: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same weakness: CWE-400
-
CVE-2026-76821
OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper -
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN -
CVE-2026-69213
Http4s Ember HTTP/2: unbounded outbound frame queue
V. Comments for CVE-2026-69208
No comments yet