http4k prior 4.51.0.0/5.42.0.0/6.50.0.0 Digest Authentication DigestAuthProvider.verify algorithm inadequate encryption

Summaryinfo

A vulnerability was found in http4k. It has been classified as problematic. The impacted element is the function DigestAuthProvider.verify of the component Digest Authentication. Performing a manipulation of the argument algorithm results in inadequate encryption. This vulnerability is identified as CVE-2026-54147. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in http4k. This affects the function DigestAuthProvider.verify of the component Digest Authentication. The manipulation of the argument algorithm with an unknown input leads to a inadequate encryption vulnerability. CWE is classifying the issue as CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. This is going to have an impact on confidentiality. The summary by CVE is:

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefore receive weaker MD5-based verification, exposing Digest authentication to collision-related attack paths that depend on the hash function's collision resistance. This issue is fixed in versions 4.51.0.0, 5.42.0.0, and 6.50.0.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-54147 since 06/11/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 4.51.0.0, 5.42.0.0 or 6.50.0.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• http4k

Website

• Product: https://github.com/http4k/http4k/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion