https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:38:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-69206 <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times. Successful replays execute authenticated requests, including state-changing operations, as the captured user. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> https://db.gcve.eu/vuln/fkie_cve-2026-69206 https://db.gcve.eu/vuln/ghsa-9xww-74xv-gjfp <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a legitimate client sends non-contiguous `nc` values (parallel or retried requests, as browsers do), the server&#39;s counter lags behind the highest `nc` seen, and a captured `Authorization` header can be replayed multiple times.</p> <p>## Impact</p> <p>A passive observer can turn one captured Digest-authenticated request into several replayed authenticated (state-changing) requests, defeating the core replay protection Digest provides over Basic.</p> <p>## Preconditions</p> <p>- Application uses `DigestAuth`. - Attacker can passively observe at least one legitimate digest request. - Legitimate client emits an `nc` more than one greater than the last, for instance from a parallel or retried request.</p> <p>## Workarounds</p> <p>- Deploy over TLS so requests cannot be captured.</p> <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a legitimate client sends non-contiguous `nc` values (parallel or retried requests, as browsers do), the server&#39;s counter lags behind the highest `nc` seen, and a captured `Authorization` header can be replayed multiple times.</p> <p>## Impact</p> <p>A passive observer can turn one captured Digest-authenticated request into several replayed authenticated (state-changing) requests, defeating the core replay protection Digest provides over Basic.</p> <p>## Preconditions</p> <p>- Application uses `DigestAuth`. - Attacker can passively observe at least one legitimate digest request. - Legitimate client emits an `nc` more than one greater than the last, for instance from a parallel or retried request.</p> <p>## Workarounds</p> <p>- Deploy over TLS so requests cannot be captured.</p> https://db.gcve.eu/vuln/ghsa-9xww-74xv-gjfp