# CVE-2026-120317 - http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

DevFeed: [CVE-2026-120317 - http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity](<https://devfeed.tech/articles/cve-2026-120317-http4k-4-9-10-0-before-6-60-0-0-digest-auth-int-missing-body-integrity-111048.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-120317>)

Author: CVEFEED.io; vulncheck.com

Published: 2026-11-02T03:17:29Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [hashing](<https://devfeed.tech/topics/hashing.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [actions](<https://devfeed.tech/tags/actions.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [body](<https://devfeed.tech/tags/body.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-120317](<https://devfeed.tech/tags/cve-2026-120317.md>), [digest](<https://devfeed.tech/tags/digest.md>), [hashing](<https://devfeed.tech/tags/hashing.md>), [header](<https://devfeed.tech/tags/header.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [request](<https://devfeed.tech/tags/request.md>), [rewrite](<https://devfeed.tech/tags/rewrite.md>), [state](<https://devfeed.tech/tags/state.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

http4k versions 4.9.10.0 up to but not including 6.60.0.0 have a missing integrity check in DigestEncoder: the auth-int digest is computed without hashing the request body. On non-TLS channels, an on-path attacker can alter an authenticated request body while leaving its Authorization header valid, potentially performing state-changing actions as the victim.

## Source excerpt

CVE ID :CVE-2026-120317 Published : Nov. 2, 2026, 3:17 a.m. | 32 minutes ago Description :http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...