Executive brief
Http4s is a Scala HTTP server library; its DigestAuth middleware handles HTTP digest authentication for protecting web resources. An attacker can trigger unauthenticated requests to the DigestAuth endpoint, causing the internal nonce cache to grow without bound, exhausting the server's memory and causing a denial of service. The vulnerability is due to an inverted comparison in the stale-nonce cleanup logic that removes fresh nonces instead of stale ones, preventing the cache from ever being properly cleaned.
Technical details
The DigestAuth server middleware in Http4s contains a logic error in its stale-nonce cleanup routine: the comparison operator is inverted, causing the cleanup to delete fresh nonces and stop at the first stale one. Because a new nonce is generated for every unauthenticated authentication challenge, an attacker can send repeated unauthenticated requests to force nonce generation, causing the nonce map to grow without bound. This gradually exhausts JVM heap memory until an out-of-memory (OOM) condition occurs, resulting in service unavailability. The attack requires no authentication, network access to the DigestAuth-protected endpoint, and causes a persistent memory leak. Patches are available: version 0.23.35 for the 0.23.x branch and 1.0.0-M47 for the 1.0.0-M series, which correct the eviction logic and impose a maximum cache size of 1,000,000 nonces.
Affected products
- http4s http4s-ember-server_2.12 <= 0.23.34
- http4s http4s-ember-server_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-ember-server_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
Timeline
- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released in versions 0.23.35 and 1.0.0-M47