Threats tagged 'ghsa-65gw-vqgg-jvcf'

A vulnerability in http4k versions from 4.9.10.0 up to but not including 6.60.0.0 allows on-path attackers on non-TLS channels to modify the body of authenticated requests without invalidating the Authorization header. This occurs because the DigestEncoder component does not hash the request entity body when computing the auth-int digest, resulting in a missing integrity check.