http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
Impact
An issue in DigestAuthProvider.verify:
Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant.
Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).
Patches
| Line | Fixed in | Edition |
|---|---|---|
| v6.x (Community) | 6.50.0.0 | Community |
| v5.x (LTS) | 5.42.0.0 | Enterprise — contact enterprise@http4k.org (if Digest auth is present in your v5.x line) |
| v4.x (LTS) | 4.51.0.0 | Enterprise — contact enterprise@http4k.org (if Digest auth is present in your v4.x line) |
The fix:
- Hashes with the configured
algorithminstead of hardcoded MD5.
Workarounds
For deployments that cannot upgrade immediately:
- Algorithm gap: do not rely on
algorithmconfiguration; assume MD5 is in use and treat the Digest credentials as low-trust.
References
- Vulnerability first present:
8a52b615b1 - Algorithm fix:
65d23d99fc - Fix release: v6.50.0.0
- Background: RFC 7616 — HTTP Digest Access Authentication
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4k:http4k-security-digest | >= 6.0.0.0, < 6.50.0.0, >= 5.0.0.0, < 5.42.0.0, <= 4.48.2.0 | 6.50.0.0, 5.42.0.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N- Weakness (CWE)
CWE-327- Platform
- Java / Kotlin (Maven)
- Package
org.http4k:http4k-security-digest- Disclosed
- 17.08.2026
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vxxm-wwqh-mh47 - CC BY 4.0
Vulnerability history: org.http4k:http4k-security-digest
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 06.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
Disclosures per year
- 2026: 3
-
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.