CVE-2026-54147: http4k http4k-security-digest weak cryptographic algorithm in DigestAuthProvider

CVE-2026-54147 · Severity: medium · CVSS 6.5 · Published 2026-09-18

http4k is a popular web framework library. Its digest authentication component allows administrators to configure which cryptographic algorithm to use for securing login credentials. However, the component ignored this configuration and always used MD5 (a weak algorithm with known collision vulnerabilities) regardless of what administrators had configured. Organizations believing they deployed stronger encryption—such as SHA-256—were unknowingly using weaker cryptography, reducing the security of user authentication and making credential compromise easier.

Technologies: Http4k-Security-Digest. Vendors: Http4k, Maven.

Quick answers

Is CVE-2026-54147 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54147 being exploited in the wild.
How severe is CVE-2026-54147?
Medium severity, with a CVSS score of 6.5, published 18 September 2026.
Which products and versions are affected?
Http4k-Security-Digest all versions <= 6.49.0.0, <= 5.41.0.0, <= 4.50.0.0; org.http4k:http4k-security-digest (Maven) ECOSYSTEM:introduced=6.0.0.0,fixed=6.50.0.0.
Is there a fix for CVE-2026-54147?
Yes. org.http4k:http4k-security-digest (Maven): upgrade to 6.50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54147 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54147?
Check whether you run Http4k-Security-Digest or org.http4k:http4k-security-digest (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4k:http4k-security-digest (Maven): upgrade to 6.50.0.0 or later
    # set org.http4k:http4k-security-digest to 6.50.0.0 in your pom.xml or build.gradle

Technical details

The vulnerability is a cryptographic algorithm hardcoding issue in DigestAuthProvider.verify (CWE-327). The configured `algorithm` parameter was ignored and every authentication verification hardcoded MD5 instead, bypassing the administrator's choice of stronger alternatives like SHA-256. This affects HTTP Digest authentication (RFC 7616), where the hash function choice is security-critical for resistance to collision attacks and credential interception. The flaw has existed since the DigestAuthProvider was introduced in commit 8a52b615b1 (2021). No authentication is required to trigger the weakness—any HTTP client connecting to a server using http4k-security-digest will use MD5 hashing regardless of server configuration. Patches are available: v6.50.0.0, v5.42.0.0, and v4.51.0.0; the fix changes the code to hash with the configured algorithm instead of hardcoded MD5.

Affected products

  • http4k http4k-security-digest all versions <= 6.49.0.0, <= 5.41.0.0, <= 4.50.0.0

Identifiers

  • CVE-2026-54147
  • GHSA-vxxm-wwqh-mh47

Timeline

  • 2021: other: Vulnerability first introduced in commit 8a52b615b1 when DigestAuthProvider was added
  • 2026-06-16: disclosed: GitHub Security Advisory GHSA-vxxm-wwqh-mh47 published
  • 2026-05-31: patched: Fix released in v6.50.0.0 (commit 65d23d99fc)
  • 2026-08-17: advisory: CVE-2026-54147 assigned and advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.