https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 06:53:46 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-100834 <p>http4k&#39;s Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid &#39;Authorization: Digest&#39; response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.</p> <p>http4k&#39;s Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid &#39;Authorization: Digest&#39; response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-100834 https://vulnerability.circl.lu/vuln/ghsa-r39r-ww5m-7mv9 <p>http4k&#39;s Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid &#39;Authorization: Digest&#39; response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.</p> <p>http4k&#39;s Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid &#39;Authorization: Digest&#39; response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.</p> https://vulnerability.circl.lu/vuln/ghsa-r39r-ww5m-7mv9