Insufficient Verification of Data Authenticity Affecting org.http4k:http4k-core package, versions [,6.49.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGHTTP4K-17732796
- published30 Jun 2026
- disclosed19 Jun 2026
- creditUnknown
Introduced: 19 Jun 2026
CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade org.http4k:http4k-core to version 6.49.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through the misleadingly named HmacSha256.hash function. An attacker can bypass message authentication by exploiting the use of an unkeyed digest where a keyed HMAC was expected. This is only exploitable if downstream callers incorrectly assume HmacSha256.hash provides keyed authentication and use it for message authentication purposes.
Workaround
This vulnerability can be mitigated by using javax.crypto.Mac.getInstance("HmacSHA256") with a SecretKeySpec for HMAC-SHA256, or java.security.MessageDigest.getInstance("SHA-256") for an unkeyed SHA-256 digest.