Executive brief
The http4k library contained a misleadingly named function that could lead developers to believe they were using a secure, keyed message authentication code (HMAC) when they were actually using a plain, unkeyed hash. If a developer relied on this function to verify the authenticity of data, an attacker could potentially forge messages because no secret key was actually being used for protection. This could lead to unauthorized data modification or bypass of security checks in applications using the library.
Technical details
The `HmacSha256.hash(payload)` function in http4k-core was misleadingly named, as it implemented a plain unkeyed SHA-256 digest rather than a keyed Hash-based Message Authentication Code (HMAC). While the class also provided a correctly implemented `hmacSHA256(key, data)` function, the existence of the unkeyed `hash` function under the `Hmac` prefix creates a risk of developer error (CWE-345). If used for message authentication, an attacker could generate valid digests for arbitrary payloads since no secret key is involved in the calculation. The vulnerability is addressed in version 6.49.0.0 by deprecating the misleading class and introducing explicit `Sha256.hash` and `Sha256.hmac` methods.
Affected products
- http4k http4k-core < 6.49.0.0
Timeline
- 2026-06-16: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched