This vulnerability has existed since 2017 and affects multiple versions across the v4, v5, and v6 branches. Because the library is widely used for building HTTP services, this poses a high risk to applications that expose endpoints accepting compressed inputs. Defenders must prioritize upgrading to the patched versions or implementing protective measures at the network edge to inspect or reject oversized request payloads.

Impact

Successful exploitation results in service unavailability due to JVM OutOfMemory errors. Any application using the affected http4k filters to process incoming requests is susceptible to unauthenticated remote exploitation. Impact is restricted to availability (DoS); there is no evidence of remote code execution or data exfiltration associated with this vulnerability.

Recommendation

• Upgrade http4k-core to the patched versions: 4.51.0.0, 5.42.0.0, or 6.49.0.0 immediately to apply the default 10MB decompression limit.
• Implement request body size limits at the edge (Load Balancer, Reverse Proxy, or WAF) to drop excessively large or potentially malicious compressed requests before they reach the application layer.
• For legacy applications that cannot be updated, implement a custom filter in the http4k pipeline that restricts the size of the InputStream before decompression occurs.

Attack Chain

1. Attacker observes legitimate Digest-protected traffic between a client and the target server.
2. Attacker performs a Man-in-the-Middle (MitM) or passive interception to capture the Authorization: Digest header.
3. Attacker identifies a different, unauthorized URL served by the same http4k-security-digest realm.
4. Attacker constructs an HTTP request targeting the unauthorized resource.
5. Attacker includes the previously captured Authorization: Digest header in the request to the new endpoint.
6. The DigestAuthProvider component processes the request and incorrectly validates the credentials because it ignores the uri mismatch.
7. Server grants access to the unauthorized resource, completing the authentication bypass.

Impact

Successful exploitation allows for the unauthorized access of any resource protected by the Digest authentication scheme within the vulnerable application realm. This vulnerability affects any deployment utilizing http4k-security-digest for authentication. The potential damage includes unauthorized data access, privilege escalation, and lateral movement within the application, depending on the sensitivity of the endpoints protected by the affected authentication provider.

Recommendation

• Upgrade to the patched versions of http4k-security-digest immediately: 6.50.0.0 (Community), 5.42.0.0 (LTS), or 4.51.0.0 (LTS).
• If an immediate upgrade is not possible, place the affected Digest authentication endpoints behind a reverse proxy that enforces strict URI binding and pins requests to a single intended URL.
• Audit application logs for patterns of the same Authorization: Digest header being reused across different cs-uri-stem paths to identify potential exploitation attempts.