CVE-2026-120317 http4k CVE debrief

Who should care

Defenders responsible for http4k deployments should assess exposure and prioritize verification and remediation efforts. This includes verifying affected http4k versions, reviewing official advisories, and implementing compensating controls to detect potential attacks. Security teams and vulnerability management teams should also prioritize this vulnerability and track exceptions and retest remediated assets.

Why it matters

CVE-2026-120317 is a high-severity vulnerability in http4k that allows on-path attackers to execute state-changing actions as the victim. Defenders should prioritize verification and remediation efforts.

• Verify affected http4k versions and upgrade to 6.60.0.0 or later
• Monitor for suspicious activity
• Implement compensating controls to detect potential attacks

Technical summary

The vulnerability is caused by a missing integrity check in DigestEncoder, which allows on-path attackers to rewrite the body of authenticated requests without invalidating the Authorization header. This can lead to state-changing actions being executed as the victim. The vulnerability affects http4k versions from 4.9.10.0 before 6.60.0.0. Defenders should prioritize verifying affected http4k versions and upgrading to 6.60.0.0 or later. They should also monitor for suspicious activity and implement compensating controls to detect potential attacks.

Defensive priority

Defenders should prioritize verifying affected http4k versions and upgrading to 6.60.0.0 or later. They should also monitor for suspicious activity and implement compensating controls to detect potential attacks.

Recommended defensive actions

• Verify http4k versions and upgrade to 6.60.0.0 or later
• Monitor for suspicious activity
• Implement compensating controls to detect potential attacks
• Review official advisories for guidance
• Assess exposure of http4k deployments
• Prioritize verification and remediation efforts
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not provide information on known exploitation or specific attack vectors. Defenders should verify affected http4k versions and review official advisories for guidance. The vulnerability's impact on http4k deployments should be assessed, and remediation efforts should be prioritized.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.