CVE-2026-69208: Memory Leak and Denial of Service in http4s DigestAuth Middleware

Vulnerability ID: CVE-2026-69208
CVSS Score: 7.5
Published: 2026-09-15

A critical memory leak vulnerability exists in the server-side DigestAuth middleware of the http4s library. Due to a logical inversion in the stale-nonce clean-up routine, the internal cache fails to evict stale nonces while prematurely purging fresh ones. Unauthenticated remote attackers can exploit this behavior by repeatedly prompting the server for authentication challenges, leading to unbounded memory consumption and application crashes via a java.lang.OutOfMemoryError.

TL;DR

An inverted logic comparison in http4s DigestAuth middleware prevents the eviction of stale cryptographic nonces while deleting fresh ones. Unauthenticated attackers can repeatedly request authentication challenges, filling the JVM heap memory until the application crashes.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400 / CWE-401
• Attack Vector: Network
• CVSS v3.1 Score: 7.5 (High)
• Attack Complexity: Low
• Privileges Required: None (Unauthenticated)
• Impact: Denial of Service (JVM Heap Exhaustion)
• Exploit Status: PoC (Proof of Concept) available in test suites
• CISA KEV Status: Not Listed

Affected Systems

• http4s server-side applications deploying the DigestAuth middleware
• http4s: < 0.23.35 (Fixed in: 0.23.35)
• http4s: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: 8cfeda8

Fix DigestAuth memory leak by correcting inverted logic on stale nonces and bounding the nonce cache size.

Mitigation Strategies

• Upgrade the http4s dependency to the latest patched version to correct the comparison logic and establish maximum cache size limits.
• Implement rate-limiting rules at the load balancer or reverse proxy level for unauthenticated requests directed at endpoints protected by DigestAuth.
• Manually override configuration parameters in newer middleware builders to limit the maximum cached nonces to a lower threshold suitable for the container's RAM limits.

Remediation Steps:

1. Identify all projects and microservices importing 'org.http4s %% http4s-server %% ' in build configurations (SBT, Maven, or Gradle).
2. For 0.23.x deployments, update the build file to reference version 0.23.35 or higher.
3. For 1.0.0-Mx deployments, update the build file to reference version 1.0.0-M47 or higher.
4. Audit application source files to ensure no deprecated initialization methods for 'NonceKeeper' are being utilized that preserve unbounded configurations.
5. Run automated unit tests to confirm dependency resolution, rebuild the application artifacts, and deploy to production.

References

• GitHub Security Advisory GHSA-fm4g-76c9-7w69
• Fix Commit on GitHub
• http4s v0.23.35 Release Tag
• http4s v1.0.0-M47 Release Tag
• CVE-2026-69208 Record on CVE.org

Read the full report for CVE-2026-69208 on our website for more details including interactive diagrams and full exploit analysis.