{"cve":"CVE-2026-69208","nvd":{"published":"2026-09-15T19:17:37.730","modified":"2026-09-17T17:16:46.390","status":"Deferred","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400","CWE-401"],"references":["https://github.com/http4s/http4s/commit/8cfeda8472954d631dfbe5dc026463a27653e482","https://github.com/http4s/http4s/releases/tag/v0.23.35","https://github.com/http4s/http4s/releases/tag/v1.0.0-M47","https://github.com/http4s/http4s/security/advisories/GHSA-fm4g-76c9-7w69"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:54:41.405518556+00:00"},"epss":{"cve":"CVE-2026-69208","score":0.00766,"percentile":0.55495,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fm4g-76c9-7w69","url":"https://osv.dev/vulnerability/GHSA-fm4g-76c9-7w69","summary":"Http4s: DigestAuth nonce map grows unbounded","modified":"2026-09-15T20:00:39.643166072Z","packages":[{"ecosystem":"Maven","name":"org.http4s:http4s-ember-server_2.12","purl":"pkg:maven/org.http4s/http4s-ember-server_2.12","ranges":["<0.23.35"],"fixed":["0.23.35"]},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-server_2.13","purl":"pkg:maven/org.http4s/http4s-ember-server_2.13","ranges":["<0.23.35"],"fixed":["0.23.35"]},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-server_3","purl":"pkg:maven/org.http4s/http4s-ember-server_3","ranges":["<0.23.35"],"fixed":["0.23.35"]},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-server_2.13","purl":"pkg:maven/org.http4s/http4s-ember-server_2.13","ranges":[">=1.0.0-M1 <1.0.0-M47"],"fixed":["1.0.0-M47"]},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-server_3","purl":"pkg:maven/org.http4s/http4s-ember-server_3","ranges":[">=1.0.0-M1 <1.0.0-M47"],"fixed":["1.0.0-M47"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}