CVE-2026-26275
📋 TL;DR
A logic flaw in httpsig-hyper versions before 0.0.23 causes digest verification to always succeed regardless of actual digest values, allowing message tampering to go undetected. This affects applications using the library for HTTP message signature validation without additional integrity checks. The vulnerability enables attackers to modify message bodies while appearing legitimate.
💻 Affected Systems
- httpsig-hyper
📦 What is this software?
Httpsig Hyper by Junkurihara
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of message integrity protection leading to undetected data manipulation, injection attacks, or privilege escalation depending on application context.
Likely Case
Message tampering that could lead to data corruption, unauthorized actions, or information disclosure in applications relying solely on this verification.
If Mitigated
Minimal impact if applications implement additional signature validation layers or message integrity checks beyond the vulnerable library.
🎯 Exploit Status
Exploitation requires sending modified HTTP messages to applications using the vulnerable library. No authentication needed if the application accepts external messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.23
Vendor Advisory: https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch
Restart Required: Yes
Instructions:
1. Update Cargo.toml to specify 'httpsig-hyper = "0.0.23"' or higher
2. Run 'cargo update'
3. Rebuild and redeploy application
4. Restart affected services
🔧 Temporary Workarounds
Disable Digest verification
allRemove or disable Digest header verification in application code
Modify application code to skip or remove calls to vulnerable digest verification functions
🧯 If You Can't Patch
- Implement application-layer message integrity checks independent of the library
- Enforce full HTTP message signature verification with additional validation mechanisms
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for httpsig-hyper version < 0.0.23Check Version:
grep -A2 -B2 httpsig-hyper Cargo.lock || grep httpsig-hyper Cargo.tomlVerify Fix Applied:
Verify version is 0.0.23 or higher in Cargo.lock and test digest verification with mismatched values📡 Detection & Monitoring
Log Indicators:
- Unexpected successful digest validations
- Message processing without proper validation logs
- Anomalous message acceptance patterns
Network Indicators:
- HTTP messages with modified bodies but valid signatures
- Unusual message patterns that should fail validation
SIEM Query:
Not applicable - application-specific logging required🔗 References
- https://github.com/junkurihara/httpsig-rs/commit/5533f596c650377e02f4aa9e3eb8dba591b87370
- https://github.com/junkurihara/httpsig-rs/commit/65cbd19b395180a4bba09a89746c4b14ccb8d297
- https://github.com/junkurihara/httpsig-rs/pull/14
- https://github.com/junkurihara/httpsig-rs/pull/15
- https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-7v42-g35v-xrch
