CVE-2026-69208

http4s, a Scala library for HTTP services, contains a resource-exhaustion flaw in its DigestAuth server middleware caused by an inverted stale-nonce comparison: eviction stops at the first stale nonce and fresh nonces are removed incorrectly, so the persistent nonce map grows without bound. On any application that protects at least one route with DigestAuth, an unauthenticated remote attacker can repeatedly send requests that trigger authentication challenges, each inserting a new nonce, until the JVM exhausts heap memory and the service crashes or stalls. The impact is denial of service only (CVSS 3.1: 7.5, availability impact); no confidentiality or integrity impact. Affected deployments are those running http4s versions prior to 0.23.35 (0.23.x series) or prior to 1.0.0-M47 (1.0.0 milestone series) that use the DigestAuth middleware. No public proof of concept is known and the issue is not listed in CISA's KEV, so exploitation is not observed in the wild.

What to do: Upgrade http4s to 0.23.35 or later (0.23.x line) or 1.0.0-M47 or later (1.0.0 milestone line), where the nonce eviction logic is fixed. If immediate upgrade is not possible, consider removing or disabling DigestAuth middleware on affected routes, or place a rate-limiting reverse proxy in front to throttle unauthenticated challenge traffic. Monitor JVM heap usage and nonce map growth on services that expose DigestAuth-protected routes to detect exploitation attempts.