The DigestEncoder in http4k computes the auth‑int digest without hashing the request entity body, allowing an attacker who can observe or modify traffic on a non‑TLS channel to replace the body of an authenticated request while preserving the Authorization header. This flaw enables the attacker to trigger state‑changing actions as the legitimate client, effectively compromising data integrity and providing unauthorized privilege escalation.

Versions of http4k from 4.9.10.0 up to, but not including, 6.60.0.0 are affected. All releases after 6.60.0.0 contain the fix and are not vulnerable; no other vendors or products are impacted.

The CVSS score of 8.2 classifies the flaw as high severity. EPSS is not available, so the current likelihood of exploitation is indeterminate, but the vulnerability is not listed in the CISA KEV catalog. Attackers require an on‑path position on a non‑TLS connection to modify request bodies. Because the exploit targets HTTP traffic, it is easier to exploit on open networks or when TLS is misconfigured, and the lack of an integrity check allows abuse without additional credentials.