CVE-2026-69206

Http4s (a Scala HTTP service framework) has a DigestAuth replay vulnerability prior to versions 0.23.35 and 1.0.0-M47 . The replay protection records lastNc + 1 instead of the highest accepted nonce-count value. When a legitimate client sends noncontiguous nc values (due to parallel or retried re...