The DigestAuth server middleware's stale-nonce cleanup uses an inverted comparison: it removes fresh nonces and stops at the first stale one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow without bound until the JVM runs out of heap.
// impact
Unauthenticated remote denial of service (gradual heap exhaustion / OOM) against any service using DigestAuth. The leak is persistent.
// preconditions
Application uses DigestAuth on at least one route.
// workarounds
Front the DigestAuth protected routes with a rate limiter to slow the leak.
Restart periodically.
// fixes
The eviction logic is corrected.
A max cache size of 1000000 is imposed to protected against a burst between evictions. This limit is not yet configurable.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Checked 2026-09-26 at 01:04 UTC. The most recent advisory here was published 2026-09-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.