Security: Replace deprecated MD5 with SHA-256 in NetworkCache (Weak Hash Algorithms finding)

We have found a Weak Hash Algorithms vulnerability in Lottie Android SDK 6.7.1 (com.airbnb.android:lottie:6.7.1) used in our LazyPay Android app.

We verified the same code exists in SDK 6.6.2 and the latest master branch. Updating the SDK does not resolve this finding.

SDK: com.airbnb.android:lottie:6.7.1
App: LazyPay Android
GitHub: https://github.com/airbnb/lottie-android

---

Finding: Weak Hash Algorithms (MD5)

The SDK uses deprecated MD5 for digest generation in network cache filename generation. Our VAPT scanner flags any MD5 usage regardless of context.

Affected Code

File: lottie/src/main/java/com/airbnb/lottie/network/NetworkCache.java

Line	Method	Issue
166	filenameForUrl()	Entry point for cache key generation
182	filenameForUrl()	sanitizedUrl = getMD5(sanitizedUrl, maxUrlLength)
188	getMD5()	Vulnerable method
191	getMD5()	MessageDigest.getInstance("MD5")
197	getMD5()	md.digest(input.getBytes())

Call Chain

getCachedFile() (Line 140, 144, 148) → filenameForUrl() → getMD5() writeTempCacheFile() (Line 95) → filenameForUrl() → getMD5() renameTempFile() (Line 123) → filenameForUrl() → getMD5()

Context

MD5 is used only to shorten long animation URL strings into valid cache filenames (Android max 255 chars). It is not used for encryption, authentication, or protection of sensitive data.

However, our security compliance requires closure of this finding and we cannot suppress it at the app level since the code ships inside the SDK AAR.

---

Impact

• Flagged as non-compliant with OWASP MASVS and internal security policies
• MD5 collision weaknesses could theoretically cause cache key collisions for different animation URLs (low practical risk for cache filenames)
• Undermines data integrity checks when scanners treat all MD5 as security-critical
• Blocks security compliance closure despite low actual risk

---

Expected Remediation

• Replace MD5 with SHA-256 in getMD5() / filenameForUrl() for cache key generation
• Rename method from getMD5() to getCacheKeyHash() using a secure algorithm
• Document migration path for existing cached files (or confirm cache invalidation on upgrade)
• Optionally expose a pluggable CacheKeyGenerator interface so apps can supply their own hashing strategy

---

Thank you for looking into this.