Maven package
org.http4k/http4k-security-digest
pkg:maven/org.http4k/http4k-security-digest
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-54148 | hig | — | >= 6.0.0.0, < 6.50.0.0 | 6.50.0.0 | Aug 17, 2026 | ### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, | |
| CVE-2026-54147 | — | >= 6.0.0.0, < 6.50.0.0 | 6.50.0.0 | Aug 17, 2026 | ### Impact An issue in `DigestAuthProvider.verify`: **Algorithm silently forced to MD5.** The configured `algorithm` parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inher |
- affected >= 6.0.0.0, < 6.50.0.0fixed 6.50.0.0
### Impact An issue in `DigestAuthProvider.verify`: The `uri` parameter in the client's `Authorization: Digest …` response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm,
- CVE-2026-54147Aug 17, 2026affected >= 6.0.0.0, < 6.50.0.0fixed 6.50.0.0
### Impact An issue in `DigestAuthProvider.verify`: **Algorithm silently forced to MD5.** The configured `algorithm` parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inher