Skip to content
Http4s vulnerabilities
Newest
-
http4s http4s-scala-xml
http4s-scala-xml has an XML External Entity (XXE) processing issue
CVE-2026-61741
Fix available
9.3 Critical
-
http4s
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
CVE-2026-88975
Fix available
7.5 High
-
http4s
Http4s: DigestAuth allows replay of captured requests
CVE-2026-69206
Fix available
5.9 Medium
-
http4s
Http4s Ember HTTP/2: unbounded inbound body buffering
CVE-2026-69202
Fix available
7.5 High
-
http4s
Http4s Ember HTTP/2: unbounded continuation frame accumulation
CVE-2026-69218
Fix available
7.5 High
-
http4s
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
CVE-2026-69203
Fix available
7.5 High
-
http4s
Http4s: Ember Server accepts duplicate Content-Length headers
CVE-2026-69217
8.7 High
-
http4s
Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
CVE-2026-69210
7.5 High
-
http4s
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
CVE-2026-69215
Fix available
6.8 Medium
-
http4s
Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
CVE-2026-69205
Fix available
8.7 High
-
http4s
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
CVE-2026-69212
Public exploit
5.9 Medium
-
http4s
Http4s Ember HTTP/2: unbounded outbound frame queue
CVE-2026-69213
Fix available
7.5 High
-
http4s
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
CVE-2026-69214
Fix available
6.8 Medium
-
http4s
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
CVE-2026-69201
Fix available
5.9 Medium
-
http4s
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
CVE-2026-69216
Fix available
5.4 Medium
-
http4s
Http4s: Set-Cookie rendering does not escape attribute delimiters
CVE-2026-69211
4.8 Medium
-
http4s
Http4s: WebSocket decoder accepts unbounded message sizes
CVE-2026-69209
7.5 High
-
http4s
Http4s: DigestAuth nonce map grows unbounded
CVE-2026-69208
Fix available
7.5 High
-
http4s
Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
CVE-2026-69204
Fix available
9.2 Critical
-
http4s, org.http4s http4s-ember-core 2.12, http4s-ember-core 2.13 +1 more +3 more
Http4s: HTTP/2 Denial of Service with Ember Backend
CVE-2026-54556
Fix available
8.2 High
-
http4s blaze
http4s-blaze-server: Unbounded WebSocket message aggregation
CVE-2026-73493
Fix available
7.5 High
-
http4s blaze
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
CVE-2026-73495
Fix available
7.4 High
-
http4s blaze, org.http4s blaze-http 2.13, blaze-http 3 +1 more +3 more
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
CVE-2026-73494
Fix available
7.4 High
-
http4s
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
CVE-2025-59822
Fix available
6.3 Medium
-
http4s
Http4s has fatal error parsing User-Agent and Server headers
CVE-2023-22465
Fix available
7.5 High
-
http4s
Response Splitting from unsanitized headers in http4s
CVE-2021-41084
Fix available
8.7 High
-
http4s
Default CORS config allows any origin with credentials
CVE-2021-39185
Fix available
9.1 Critical
-
http4s
StaticFile.fromUrl can leak presence of a directory
CVE-2021-32643
Fix available
5.8 Medium
-
http4s
Unbounded connection acceptance in http4s-blaze-server
CVE-2021-21294
Fix available
7.5 High
-
http4s blaze
Unbounded connection acceptance leads to file handle exhaustion
CVE-2021-21293
Fix available
7.5 High
-
http4s
Local file inclusion vulnerability in http4s
CVE-2020-5280
Fix available
7.6 High