Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120317http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

Medium 5.9

In plain English

A medium-severity insufficient verification of data authenticity in http4k from http4k. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.1%top 98.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

Affected products (as reported)

Vendor	Product	Versions
http4k	http4k	4.9.10.0 – before 6.60.0.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-9xx4-xjpj-xqcf) vendor-advisory
VulnCheck Advisory: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity third-party-advisory