---
id: CVE-2026-69208
title: Http4s is a Scala interface for HTTP services
summary: >-
  Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47,
  the DigestAuth server middleware removes fresh nonces and stops eviction at
  the first stale nonce because its stale-nonce comparison is inverted. On an
  applic…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-401
vendor: http4s
product: http4s
affected:
  - http4s < 0.23.35
  - 'http4s >= 1.0.0-M1, < 1.0.0-M47'
patched:
  - 'org.http4s:http4s-ember-server_2.12 0.23.35'
  - 'org.http4s:http4s-ember-server_2.13 0.23.35'
  - 'org.http4s:http4s-ember-server_3 0.23.35'
  - 'org.http4s:http4s-ember-server_2.13 1.0.0-M47'
  - 'org.http4s:http4s-ember-server_3 1.0.0-M47'
published: '2026-09-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:46.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69208'
references:
  - url: >-
      https://github.com/http4s/http4s/commit/8cfeda8472954d631dfbe5dc026463a27653e482
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v0.23.35'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v1.0.0-M47'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/security/advisories/GHSA-fm4g-76c9-7w69'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-fm4g-76c9-7w69'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T16:41:41.318498Z'
epss: 0.00766
epssPercentile: 0.53514
aliases:
  - GHSA-fm4g-76c9-7w69
ecosystem: maven
ingestedAt: '2026-09-15T19:42:58.803Z'
---

## Overview

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69208)

Affected packages:

- `org.http4s:http4s-ember-server_2.12 <= 0.23.34`
- `org.http4s:http4s-ember-server_2.13 <= 0.23.34`
- `org.http4s:http4s-ember-server_3 <= 0.23.34`
- `org.http4s:http4s-ember-server_2.13 >= 1.0.0-M1, <= 1.0.0-M46`
- `org.http4s:http4s-ember-server_3 >= 1.0.0-M1, <= 1.0.0-M46`

Patched in:

- `org.http4s:http4s-ember-server_2.12 0.23.35`
- `org.http4s:http4s-ember-server_2.13 0.23.35`
- `org.http4s:http4s-ember-server_3 0.23.35`
- `org.http4s:http4s-ember-server_2.13 1.0.0-M47`
- `org.http4s:http4s-ember-server_3 1.0.0-M47`

Source: https://github.com/advisories/GHSA-fm4g-76c9-7w69