{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/http4k/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["http4k-core"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","web-server"],"_cs_type":"advisory","_cs_vendors":["http4k"],"content_html":"\u003cp\u003eThe http4k library (http4k-core) contains a vulnerability in its \u003ccode\u003eServerFilters.GZip\u003c/code\u003e and \u003ccode\u003eRequestFilters.GunZip\u003c/code\u003e components, where incoming request bodies are decompressed without verifying the final, expanded size. This flaw, tracked as CVE-2026-53659, allows an attacker to send a maliciously crafted, highly compressed gzip request of only a few kilobytes. Upon processing, the request expands significantly within the JVM heap, leading to memory exhaustion and a complete denial-of-service for the affected server.\u003c/p\u003e\n\u003cp\u003eThis vulnerability has existed since 2017 and affects multiple versions across the v4, v5, and v6 branches. Because the library is widely used for building HTTP services, this poses a high risk to applications that expose endpoints accepting compressed inputs. Defenders must prioritize upgrading to the patched versions or implementing protective measures at the network edge to inspect or reject oversized request payloads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability due to JVM OutOfMemory errors. Any application using the affected http4k filters to process incoming requests is susceptible to unauthenticated remote exploitation. Impact is restricted to availability (DoS); there is no evidence of remote code execution or data exfiltration associated with this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ehttp4k-core\u003c/code\u003e to the patched versions: 4.51.0.0, 5.42.0.0, or 6.49.0.0 immediately to apply the default 10MB decompression limit.\u003c/li\u003e\n\u003cli\u003eImplement request body size limits at the edge (Load Balancer, Reverse Proxy, or WAF) to drop excessively large or potentially malicious compressed requests before they reach the application layer.\u003c/li\u003e\n\u003cli\u003eFor legacy applications that cannot be updated, implement a custom filter in the http4k pipeline that restricts the size of the \u003ccode\u003eInputStream\u003c/code\u003e before decompression occurs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:46:52Z","date_published":"2026-08-18T00:46:52Z","id":"https://feed.craftedsignal.io/briefs/2026-08-http4k-dos/","summary":"The http4k library fails to limit the size of decompressed gzip data, allowing unauthenticated remote attackers to trigger JVM heap exhaustion via small, highly compressed payloads.","title":"Unbounded Gzip Decompression Denial of Service in http4k","url":"https://feed.craftedsignal.io/briefs/2026-08-http4k-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["http4k-security-digest"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["http4k"],"content_html":"\u003cp\u003eThe http4k-security-digest library, a component of the http4k framework, contains a vulnerability (CVE-2026-54148) that compromises the integrity of HTTP Digest authentication. The \u003ccode\u003eDigestAuthProvider\u003c/code\u003e component fails to verify that the \u003ccode\u003euri\u003c/code\u003e parameter provided within an \u003ccode\u003eAuthorization: Digest\u003c/code\u003e header matches the actual request URL. Because this binding is missing, an attacker who captures a valid Digest authentication response can successfully replay that credential to authenticate against any other resource protected by the same security realm. This flaw undermines the core security design of the Digest authentication scheme as described in RFC 7616. The vulnerability has been present in the codebase since commit 8a52b615b1, introduced in 2021. Impacted users should upgrade to the corrected versions (6.50.0.0, 5.42.0.0, or 4.51.0.0) or implement compensatory controls such as reverse proxy URL pinning.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker observes legitimate Digest-protected traffic between a client and the target server.\u003c/li\u003e\n\u003cli\u003eAttacker performs a Man-in-the-Middle (MitM) or passive interception to capture the \u003ccode\u003eAuthorization: Digest\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a different, unauthorized URL served by the same http4k-security-digest realm.\u003c/li\u003e\n\u003cli\u003eAttacker constructs an HTTP request targeting the unauthorized resource.\u003c/li\u003e\n\u003cli\u003eAttacker includes the previously captured \u003ccode\u003eAuthorization: Digest\u003c/code\u003e header in the request to the new endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eDigestAuthProvider\u003c/code\u003e component processes the request and incorrectly validates the credentials because it ignores the \u003ccode\u003euri\u003c/code\u003e mismatch.\u003c/li\u003e\n\u003cli\u003eServer grants access to the unauthorized resource, completing the authentication bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized access of any resource protected by the Digest authentication scheme within the vulnerable application realm. This vulnerability affects any deployment utilizing \u003ccode\u003ehttp4k-security-digest\u003c/code\u003e for authentication. The potential damage includes unauthorized data access, privilege escalation, and lateral movement within the application, depending on the sensitivity of the endpoints protected by the affected authentication provider.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to the patched versions of http4k-security-digest immediately: 6.50.0.0 (Community), 5.42.0.0 (LTS), or 4.51.0.0 (LTS).\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, place the affected Digest authentication endpoints behind a reverse proxy that enforces strict URI binding and pins requests to a single intended URL.\u003c/li\u003e\n\u003cli\u003eAudit application logs for patterns of the same \u003ccode\u003eAuthorization: Digest\u003c/code\u003e header being reused across different \u003ccode\u003ecs-uri-stem\u003c/code\u003e paths to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:46:37Z","date_published":"2026-08-18T00:46:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-http4k-digest-auth/","summary":"The http4k-security-digest library fails to validate the URI parameter in Digest authentication responses, enabling attackers to replay captured authentication credentials against unauthorized endpoints within the same realm.","title":"Authentication Bypass in http4k-security-digest via Digest URI Replay","url":"https://feed.craftedsignal.io/briefs/2026-08-http4k-digest-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Http4k","version":"https://jsonfeed.org/version/1.1"}