MEDIUM 6.5 GitHub
CVE-2026-54147
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI
### Impact
An issue in `DigestAuthProvider.verify`:
**Algorithm silently forced to MD5.** The configured `algorithm` parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant.
**Who is affected:** any application using `http4k-security-digest` for HTTP Di
Affected Products
- maven/org.http4k:http4k-security-digest >= 5.0.0.0, < 5.42.0.0
- maven/org.http4k:http4k-security-digest <= 4.48.2.0
- maven/org.http4k:http4k-security-digest >= 6.0.0.0, < 6.50.0.0
References
- https://github.com/advisories/GHSA-vxxm-wwqh-mh47
- https://github.com/http4k/http4k/security/advisories/GHSA-vxxm-wwqh-mh47
- https://github.com/http4k/http4k/commit/65d23d99fc
- https://github.com/http4k/http4k/releases/tag/6.50.0.0
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-17 via GitHub. Affected: maven/org.http4k:http4k-security-digest >= 5.0.0.0, < 5.42.0.0, maven/org.http4k:http4k-security-digest <= 4.48.2.0, maven/org.http4k:http4k-security-digest >= 6.0.0.0, < 6.50.0.0.
vulnfeed aggregates 11051 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.