MEDIUMMaven
GHSA-c7jm-38gq-h67h· CVE-2026-100834http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Modified: 9/27/2026
package
Maven/org.http4k:http4k-security-digest
pkg:maven/org.http4k:http4k-security-digest
HIGH8.1Maven
GHSA-p28p-j94q-pg32· CVE-2026-54148http4k: `DigestAuthProvider.verify` did not bind to request URI
Modified: 9/24/2026
MEDIUM6.5Maven
GHSA-vxxm-wwqh-mh47· CVE-2026-54147http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Modified: 8/17/2026