Answer in brief
CVE-2026-54148 records a High severity vulnerability in http4k: `DigestAuthProvider.verify` did not bind to request URI. The current sources do not mark it as known exploited. The current feed maps http4k/http4k (generic), org.http4k:http4k-security-digest (maven), org.http4k:http4k-security-digest (maven), org.http4k:http4k-security-digest (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps http4k/http4k (generic), org.http4k:http4k-security-digest (maven), org.http4k:http4k-security-digest (maven), org.http4k:http4k-security-digest (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| http4k/http4kgeneric | < 4.51.0.0 || >= 5.0.0.0, < 5.42.0.0 || >= 6.0.0.0, < 6.50.0.0 | Not reported |
| org.http4k:http4k-security-digestmaven | >=6.0.0.0,<6.50.0.0 | 6.50.0.0 |
| org.http4k:http4k-security-digestmaven | >=5.0.0.0,<5.42.0.0 | 5.42.0.0 |
| org.http4k:http4k-security-digestmaven | <=4.48.2.0 | Not reported |
Published upstream
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest authentication response can replay it against another URL served by the same realm, bypassing the per-request-URI binding and potentially gaining unauthorized read or write access. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.50.0.0.
Quoted source text, attributed separately from HOL analysis.