Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven
Not in CISA KEV

GHSA-c7jm-38gq-h67h

Fix: http4k/http4k@4f904b4

GHSA-c7jm-38gq-h67h is a security vulnerability in org.http4k:http4k-security-digest. O3 Security confirms whether GHSA-c7jm-38gq-h67h is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments

Published
Jun 19, 2026
Updated
Jun 19, 2026
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Jun 19, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
☕org.http4k:http4k-security-digest☕org.http4k:http4k-security-digest☕org.http4k:http4k-security-digest

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

ServerFilters.DigestAuth and the underlying DigestAuthProvider both defaulted their nonceVerifier parameter to { true } — i.e. every nonce was accepted regardless of value, age, or prior use. Any deployment using the default configuration had no replay protection on Digest authentication; a captured Authorization: Digest … response could be replayed indefinitely against the same protected resource.

The nonce-verification mechanism in Digest auth is the primary anti-replay control — without it, Digest reduces to a credential bound only to a stale nonce string.

Who is affected: any application using ServerFilters.DigestAuth or DigestAuthProvider with the default nonceVerifier. The broken default has been present since DigestAuthProvider was introduced (2021). Exploitation requires the attacker to first capture a valid Digest response (network observation, log access, etc.) — non-trivial in modern TLS deployments but not impossible. Anyone running Digest auth with default config should treat upgrade as urgent.

Patches

LineFixed inEdition
v6.x (Community)6.48.0.0Community
v5.x (LTS)5.42.0.0Enterprise — contact [email protected] (if Digest auth is present in your v5.x line)
v4.x (LTS)4.51.0.0Enterprise — contact [email protected] (if Digest auth is present in your v4.x line)

The fix ([Break]) removes the default value for nonceVerifier from both ServerFilters.DigestAuth and DigestAuthProvider. Callers must now supply a real verifier explicitly — the broken default cannot be silently inherited.

Workarounds

For deployments that cannot upgrade immediately: explicitly supply a nonceVerifier that tracks issued nonces, enforces a TTL, and rejects re-use. Do not rely on the default.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.http4k:http4k-security-digest≥ 6.0.0.0&&< 6.48.0.06.48.0.0
☕Mavenorg.http4k:http4k-security-digest≥ 5.0.0.0&&< 5.42.0.05.42.0.0
☕Mavenorg.http4k:http4k-security-digestall versions4.51.0.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.http4k:http4k-security-digest. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update org.http4k:http4k-security-digest to 6.48.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c7jm-38gq-h67h is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-c7jm-38gq-h67h is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-c7jm-38gq-h67h. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact `ServerFilters.DigestAuth` and the underlying `DigestAuthProvider` both defaulted their `nonceVerifier` parameter to `{ true }` — i.e. every nonce was accepted regardless of value, age, or prior use. Any deployment using the default configuration had **no replay protection** on Digest authentication; a captured `Authorization: Digest …` response could be replayed indefinitely against the same protected resource. The nonce-verification mechanism in Digest auth is the primary anti-replay control — without it, Digest reduces to a credential bound only to a stale nonce string. **Who
O3 Security · Impact-Aware SCA

Is GHSA-c7jm-38gq-h67h in your dependencies?

O3 detects GHSA-c7jm-38gq-h67h across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works
GHSA-c7jm-38gq-h67h: http4k-security-digest | O3 Security