CVE-2026-69208: Http4s DigestAuth DoS Vulnerability

CVE-2026-69208 Overview

CVE-2026-69208 is a denial-of-service vulnerability in http4s, a Scala interface for HTTP services. The flaw resides in the DigestAuth server middleware, where an inverted stale-nonce comparison causes the eviction routine to remove fresh nonces and stop scanning at the first stale entry. On any application that protects at least one route with DigestAuth, an unauthenticated remote attacker can repeatedly trigger authentication challenges. The persistent nonce map grows unbounded until the Java Virtual Machine (JVM) exhausts heap memory. The issue affects http4s versions prior to 0.23.35 and 1.0.0-M47 and is categorized as uncontrolled resource consumption [CWE-400].

Critical Impact
An unauthenticated network attacker can crash any http4s application that uses DigestAuth by exhausting JVM heap memory through repeated authentication challenges.

Affected Products

http4s versions prior to 0.23.35
http4s 1.0 milestones prior to 1.0.0-M47
Any Scala HTTP service using the DigestAuth server middleware

Discovery Timeline

2026-09-15 - CVE-2026-69208 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-69208

Vulnerability Analysis

The DigestAuth middleware maintains a NonceKeeper cache of issued nonces to validate subsequent authentication attempts. The keeper periodically evicts stale nonces from this map. The eviction logic performs a comparison to determine whether a nonce has aged beyond staleTimeout. That comparison is inverted, so the routine removes fresh nonces while retaining stale ones and terminates on the first stale entry it encounters.

When the middleware serves an unauthenticated request, it issues a fresh nonce and stores it in the map. An attacker who repeatedly requests any protected route generates a new nonce on every challenge. Because eviction fails to reclaim aged entries, the map grows without bound. The JVM eventually throws OutOfMemoryError and the process terminates.

Root Cause

The defect lives in server/shared/src/main/scala/org/http4s/server/middleware/authentication/NonceKeeper.scala. The stale-nonce predicate returns the opposite of what the eviction loop expects. The loop also exits at the first entry classified as stale rather than continuing across the map, compounding the effect. No cap existed on the total number of retained nonces prior to the fix.

Attack Vector

Exploitation requires only network access to a single route protected by DigestAuth. No credentials, user interaction, or elevated privileges are required. Each unauthenticated request that triggers the digest challenge adds a nonce to a map that never shrinks.

text

// Patch excerpt from DigestAuth.scala
-  @deprecated("Calling apply is side-effecting, please use applyF", "0.23.12")
+  @deprecated(
+    "Calling apply is side-effecting with an unbounded nonce cache.  Please use applyF.",
+    "0.23.12",
+  )
   def apply[F[_]: Sync, A](
       realm: String,
       store: String => F[Option[(A, String)]],

Source: GitHub commit 8cfeda8

The patch also corrects the stale comparison in NonceKeeper.scala and introduces an upper bound on the nonce cache to prevent unbounded growth even under aggressive challenge traffic.

Detection Methods for CVE-2026-69208

Indicators of Compromise

Sustained JVM heap growth on http4s services that expose DigestAuth-protected routes without a corresponding increase in authenticated sessions.
Frequent OutOfMemoryError events or JVM restarts on services using vulnerable http4s versions.
High-volume unauthenticated request patterns targeting endpoints that respond with WWW-Authenticate: Digest challenges.

Detection Strategies

Inventory Scala services and inspect build files (build.sbt, pom.xml) for org.http4s dependencies below 0.23.35 or 1.0.0-M47.
Instrument JVMs with heap and garbage-collection metrics, and alert on sustained old-generation growth on hosts running http4s.
Correlate application logs for repeated 401 Unauthorized responses from the same source addresses over short windows.

Monitoring Recommendations

Track HTTP 401 response rates per client IP on DigestAuth-protected endpoints and alert on abnormal spikes.
Monitor JVM HeapMemoryUsage and OutOfMemoryError events through JMX or the application performance monitoring stack.
Enable rate-limiting logs at the reverse proxy layer for unauthenticated requests to identify challenge-flooding behavior.

How to Mitigate CVE-2026-69208

Immediate Actions Required

Upgrade http4s to 0.23.35 (for the 0.23.x line) or 1.0.0-M47 (for the 1.0 milestone line).
Rebuild and redeploy all Scala services that transitively depend on vulnerable http4s versions.
Apply rate limiting at an upstream proxy for endpoints protected by DigestAuth until patched builds are deployed.

Patch Information

The fix is delivered in http4s 0.23.35 and 1.0.0-M47. See the GitHub Security Advisory GHSA-fm4g-76c9-7w69, the v0.23.35 release notes, and the v1.0.0-M47 release notes. The patch corrects the stale-nonce comparison, continues eviction across the full map, and imposes an upper bound on the nonce cache.

Workarounds

Replace DigestAuth with an alternative authentication middleware (for example, Basic authentication over TLS or token-based authentication) until upgrade is possible.
Place a rate-limiting reverse proxy in front of the service to cap unauthenticated request volume per source.
Configure JVM restart automation so heap exhaustion does not result in prolonged outage.

bash

# Example sbt dependency update
libraryDependencies ++= Seq(
  "org.http4s" %% "http4s-server" % "0.23.35",
  "org.http4s" %% "http4s-dsl"    % "0.23.35"
)