THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9xww-74xv-gjfp (medium) — Http4s: DigestAuth allows replay of captured requests

[GHSA] GHSA-9xww-74xv-gjfp (medium) — Http4s: DigestAuth allows replay of captured requests

medgithub_advisoriesPublished 2026-09-15

GHSA-9xww-74xv-gjfp Severity: medium CVE: CVE-2026-69206

Http4s: DigestAuth allows replay of captured requests

The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a legitimate client sends non-contiguous `nc` values (parallel or retried requests, as browsers do), the server's counter lags behind the highest `nc` seen, and a captured

Indicators of compromise

CVE-2026-69206cve

Original source: https://github.com/advisories/GHSA-9xww-74xv-gjfp