When a service uses Http4s DigestAuth, every time an unauthenticated client requests protected content a nonce is generated and stored. The code that removes old nonces incorrectly stops eviction after the first stale entry, so the nonce cache grows without bound. Over time the Java Virtual Machine’s heap becomes saturated, causing the application to crash or become unresponsive. The vulnerability is a form of resource exhaustion that can be triggered by any client able to request authenticated routes.

Any deployment of http4s that uses a DigestAuth server middleware version earlier than 0.23.35 or 1.0.0-M47 is affected. This includes all Scala applications that depend on those http4s releases and expose at least one route protected by DigestAuth. The fix is available in the 0.23.35 and 1.0.0-M47 release builds.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score of <1% indicates a very low likelihood of exploitation, although it is not zero, but the absence of a KEV listing does not preclude abuse. The likely attack path requires an unauthenticated client sending repeated authentication challenges to a protected endpoint; the attack is straightforward once the target is reachable over the network. An attacker capable of this can cause the application to consume all available heap space, resulting in service disruption. In the absence of mitigation, the memory exhaustion could be accelerated by a high rate of requests, increasing the risk of a denial of service within minutes.