Typelevel vulnerabilities

Products

• Http4s 7
• Jawn 4
• Fs2 2

Newest

• typelevel jawn Jawn: Uncontrolled nesting depth in JSON parser CVE-2026-59990 Fix available 7.5 HighSeptember 23, 2026
• typelevel jawn, org.typelevel jawn-parser 2.12, jawn-parser 2.13 +1 more +3 more Jawn: Quadratic parsing effort in AsyncParser CVE-2026-61814 Fix available 7.5 HighSeptember 23, 2026
• mvpthemes jawn WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability CVE-2026-66648 9.8 CriticalAugust 24, 2026
• http4s Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVE-2025-59822 Fix available 6.3 MediumSeptember 23, 2025
• typelevel fs2 fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side CVE-2025-58369 Fix available 5.3 MediumSeptember 5, 2025
• typelevel grackle Grackle has StackOverflowError in GraphQL query processing CVE-2023-50730 Fix available 7.5 HighDecember 18, 2023
• http4s Http4s has fatal error parsing User-Agent and Server headers CVE-2023-22465 Fix available 7.5 HighJanuary 4, 2023
• typelevel fs2 mTLS client verification is skipped in fs2 on Node.js CVE-2022-31183 Fix available 9.1 CriticalJuly 29, 2022
• typelevel jawn Hash collision in typelevel jawn CVE-2022-21653 Fix available 5.9 MediumJanuary 5, 2022
• http4s Response Splitting from unsanitized headers in http4s CVE-2021-41084 Fix available 8.7 HighSeptember 21, 2021
• http4s Default CORS config allows any origin with credentials CVE-2021-39185 Fix available 9.1 CriticalSeptember 1, 2021
• http4s StaticFile.fromUrl can leak presence of a directory CVE-2021-32643 Fix available 5.8 MediumMay 27, 2021
• http4s Unbounded connection acceptance in http4s-blaze-server CVE-2021-21294 Fix available 7.5 HighFebruary 2, 2021
• http4s blaze Unbounded connection acceptance leads to file handle exhaustion CVE-2021-21293 Fix available 7.5 HighFebruary 2, 2021
• http4s Local file inclusion vulnerability in http4s CVE-2020-5280 Fix available 7.6 HighMarch 25, 2020