# CVE-2026-69206: Http4s DigestAuth replay attack in authorization header

Source: https://junglewise.ai/threats/cve-2026-69206-http4s-digestauth-replay-attack-in-authorization-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69206 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Http4s is an HTTP server library that implements Digest Authentication to protect API endpoints from unauthorized access. A flaw in its replay-attack defense allows an attacker who observes a single authenticated request to replay it multiple times, potentially making unauthorized state-changing requests (e.g., fund transfers, data modifications) as if they were from a legitimate user. This defeats the core security benefit that Digest Authentication provides over simpler Basic Authentication.

Technologies: [Http4s](https://junglewise.ai/threats/technologies/http4s), [org.http4s:http4s-ember-core_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-12), [org.http4s:http4s-ember-core_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-13), [org.http4s:http4s-ember-core_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69206 being exploited in the wild.

**How severe is CVE-2026-69206?** Medium severity, with a CVSS score of 5.9, published 15 September 2026.

**Which products and versions are affected?** Http4s <= 0.23.34 (fixed in 0.23.35); 1.0.0-M1 to 1.0.0-M46 (fixed in 1.0.0-M47); org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

**Is there a fix for CVE-2026-69206?** Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69206?** Check whether you run Http4s, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle
  ```


## Technical details

The DigestAuth implementation in Http4s stores `lastNc + 1` (one more than the last seen nonce-count) instead of the actual `nc` value it just accepted. When legitimate clients send non-contiguous `nc` values—such as during parallel or retried requests, which browsers commonly do—the server's counter lags behind the highest `nc` seen. This allows a passive network observer to capture a single `Authorization` header and replay it multiple times before the server's counter catches up, bypassing the replay protection mechanism. The attack requires no authentication privileges and network accessibility but does require observing legitimate traffic. Patched versions are 0.23.35 for the 0.23.x branch and 1.0.0-M47 for the 1.0.0-M branch.

## Affected products

- Http4s http4s-ember-core <= 0.23.34 (fixed in 0.23.35); 1.0.0-M1 to 1.0.0-M46 (fixed in 1.0.0-M47)

## Identifiers

- CVE-2026-69206
- GHSA-9xww-74xv-gjfp

## Timeline

- 2026-07-06: disclosed
- 2026-09-15: advisory: Published to GitHub Advisory Database

## References

- [https://api.github.com/users/rossabaker](https://api.github.com/users/rossabaker)
- [https://github.com/rossabaker](https://github.com/rossabaker)
- [https://api.github.com/users/rossabaker/gists%7B/gist_id%7D](https://api.github.com/users/rossabaker/gists%7B/gist_id%7D)
- [https://api.github.com/users/rossabaker/repos](https://api.github.com/users/rossabaker/repos)
- [https://avatars.githubusercontent.com/u/142698?v=4](https://avatars.githubusercontent.com/u/142698?v=4)
- [https://api.github.com/users/rossabaker/events%7B/privacy%7D](https://api.github.com/users/rossabaker/events%7B/privacy%7D)

## Related threats

- [Http4s Ember HTTP/2 frame buffering denial of service](https://junglewise.ai/threats/cve-2026-88975-http4s-ember-http-2-frame-buffering-denial-of-service)
- [Http4s Ember HTTP/2 unbounded continuation frame accumulation](https://junglewise.ai/threats/cve-2026-69218-http4s-ember-http-2-unbounded-continuation-frame-accumulation)
- [Http4s Ember HTTP/1.1 parser request smuggling via duplicate Content-Length](https://junglewise.ai/threats/cve-2026-69217-http4s-ember-http-1-1-parser-request-smuggling-via-duplicate)
- [Http4s WebSocket decoder negative length handling denial of service](https://junglewise.ai/threats/cve-2026-69210-http4s-websocket-decoder-negative-length-handling-denial-of)
- [Http4s Ember HTTP request smuggling via Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2026-69205-http4s-ember-http-request-smuggling-via-transfer-encoding-parsing)