# CVE-2026-69208: Http4s DigestAuth memory exhaustion via unbounded nonce cache

Source: https://junglewise.ai/threats/cve-2026-69208-http4s-digestauth-memory-exhaustion-via-unbounded-nonce-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69208 · Severity: high · CVSS 7.5 · Published 2026-09-15

Http4s is a Scala HTTP server library; its DigestAuth middleware handles HTTP digest authentication for protecting web resources. An attacker can trigger unauthenticated requests to the DigestAuth endpoint, causing the internal nonce cache to grow without bound, exhausting the server's memory and causing a denial of service. The vulnerability is due to an inverted comparison in the stale-nonce cleanup logic that removes fresh nonces instead of stale ones, preventing the cache from ever being properly cleaned.

Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69208 being exploited in the wild.

**How severe is CVE-2026-69208?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** Http4s-Ember-Server <= 0.23.34; org.http4s:http4s-ember-server_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-server_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-server_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

**Is there a fix for CVE-2026-69208?** Yes. org.http4s:http4s-ember-server_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-server_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-server_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69208 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69208?** Check whether you run Http4s-Ember-Server, org.http4s:http4s-ember-server_2.12 (Maven), org.http4s:http4s-ember-server_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-ember-server_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-server_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-server_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-server_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-server_3 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-server_3 to 0.23.35 in your pom.xml or build.gradle
  ```


## Technical details

The DigestAuth server middleware in Http4s contains a logic error in its stale-nonce cleanup routine: the comparison operator is inverted, causing the cleanup to delete fresh nonces and stop at the first stale one. Because a new nonce is generated for every unauthenticated authentication challenge, an attacker can send repeated unauthenticated requests to force nonce generation, causing the nonce map to grow without bound. This gradually exhausts JVM heap memory until an out-of-memory (OOM) condition occurs, resulting in service unavailability. The attack requires no authentication, network access to the DigestAuth-protected endpoint, and causes a persistent memory leak. Patches are available: version 0.23.35 for the 0.23.x branch and 1.0.0-M47 for the 1.0.0-M series, which correct the eviction logic and impose a maximum cache size of 1,000,000 nonces.

## Affected products

- http4s http4s-ember-server_2.12 <= 0.23.34
- http4s http4s-ember-server_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-ember-server_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46

## Identifiers

- CVE-2026-69208
- GHSA-fm4g-76c9-7w69

## Timeline

- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released in versions 0.23.35 and 1.0.0-M47

## References

- [https://api.github.com/users/rossabaker](https://api.github.com/users/rossabaker)
- [https://github.com/rossabaker](https://github.com/rossabaker)
- [https://api.github.com/users/rossabaker/gists%7B/gist_id%7D](https://api.github.com/users/rossabaker/gists%7B/gist_id%7D)
- [https://api.github.com/users/rossabaker/repos](https://api.github.com/users/rossabaker/repos)
- [https://avatars.githubusercontent.com/u/142698?v=4](https://avatars.githubusercontent.com/u/142698?v=4)
- [https://api.github.com/users/rossabaker/events%7B/privacy%7D](https://api.github.com/users/rossabaker/events%7B/privacy%7D)

## Related threats

- [http4s WebSocket decoder unbounded message buffering](https://junglewise.ai/threats/cve-2026-69209-http4s-websocket-decoder-unbounded-message-buffering)