CVE-2026-69206: Http4s: DigestAuth allows replay of captured requests
The DigestAuth replay defence stores lastNc + 1 rather than the nonce-count (nc) value it just accepted. When a legitimate client sends non-contiguous nc values (parallel or retried requests, as browsers do), the server’s counter lags behind the highest nc seen, and a captured Authorization header can be replayed multiple times.
References
- github.com/advisories/GHSA-9xww-74xv-gjfp
- github.com/http4s/http4s/commit/7f065101c45f3d86bc105e8fc6323c2c4a11471f
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-9xww-74xv-gjfp
- nvd.nist.gov/vuln/detail/CVE-2026-69206
Code Behaviors & Features
Detect and mitigate CVE-2026-69206 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →