Http4s: DigestAuth allows replay of captured requests
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-69206
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 13:16 UTC · Revision 1
Source evidence
Http4s: DigestAuth allows replay of captured requests
core-osv · Original sourcePublished 15 Sept 2026, 19:29 UTC
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
osv:CVE-2026-69206
Complete source record
{
"id": "c3bd2e1336590b68eee47a2ba28634c62b68ce507cda60e6a16f904dd42b8fa2",
"url": "https://osv.dev/vulnerability/CVE-2026-69206",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Http4s: DigestAuth allows replay of captured requests",
"summary": "Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.",
"evidence": "osv:CVE-2026-69206",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-69206",
"aliases": [
"CVE-2026-69206",
"GHSA-9xww-74xv-gjfp"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/http4s/http4s",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
},
{
"introduced": "756ce63aee681c5b632bbeafe0b8fde2f3d237f4"
},
{
"fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
},
{
"fixed": "7f065101c45f3d86bc105e8fc6323c2c4a11471f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.23.35"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M47"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "7f065101c45f3d86bc105e8fc6323c2c4a11471f"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.23.35"
},
{
"range": [
{
"fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.0.0-M47"
}
]
}
}
],
"versions": [
"v1.0.0-M46",
"v0.23.34",
"v0.23.33",
"v1.0.0-M45",
"v0.23.32",
"v0.23.31",
"v1.0.0-M44",
"v0.23.30",
"v1.0.0-M43",
"v1.0.0-M42",
"v0.23.29",
"v0.23.28",
"v0.23.27",
"v1.0.0-M41",
"v0.23.26",
"v0.23.25",
"v0.23.24",
"v0.23.23",
"v1.0.0-M40",
"v0.23.22",
"v0.23.20",
"v0.23.19",
"v0.23.19-RC2",
"v0.23.19-RC1",
"v1.0.0-M39",
"v0.23.18",
"v1.0.0-M37",
"v0.23.16",
"v1.0.0-M36",
"v0.23.15",
"v1.0.0-M35",
"v0.23.14",
"v1.0.0-M34",
"v0.23.13",
"v1.0.0-M33",
"v0.23.12",
"v1.0.0-M32",
"v0.23.11",
"v1.0.0-M31",
"v0.23.10",
"v0.23.9",
"v0.23.8",
"v1.0.0-M30",
"v0.23.7",
"v1.0.0-M29",
"v0.23.6",
"v0.23.5",
"v1.0.0-M28",
"v0.23.3",
"v1.0.0-M26",
"v0.23.2",
"v1.0.0-M24",
"v0.23.1",
"v0.23.0",
"v1.0.0-M22",
"v0.23.0-M1",
"v1.0.0-M21",
"v1.0.0-M20",
"v1.0.0-M19",
"v1.0.0-M17",
"v1.0.0-M16",
"v1.0.0-M15",
"v1.0.0-M13",
"v1.0.0-M12",
"v1.0.0-M11",
"v1.0.0-M10",
"v1.0.0-M9",
"v1.0.0-M8",
"v1.0.0-M7",
"v1.0.0-M6",
"v1.0.0-M5",
"v1.0.0-M4",
"v1.0.0-M3",
"v1.0.0-M2",
"v1.0.0-M1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69206.json"
}
}
],
"modified": "2026-10-28T02:30:28.996336950Z",
"provider": "osv",
"references": [
"https://github.com/http4s/http4s/releases/tag/v0.23.35",
"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69206.json",
"https://github.com/http4s/http4s/security/advisories/GHSA-9xww-74xv-gjfp",
"https://nvd.nist.gov/vuln/detail/CVE-2026-69206",
"https://github.com/http4s/http4s/commit/7f065101c45f3d86bc105e8fc6323c2c4a11471f"
],
"provider_metadata": {
"cwe_ids": [
"CWE-294"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69206.json"
}
},
"related_cves": [
{
"value": "CVE-2026-69206",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 495763,
"published_at": "2026-09-15T19:29:40.341+00:00"
}