- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 1 critical, 7 high, 3 medium
- Dependents
- 2
- Registry
- Maven Central
Advisories 11
- CVE-2026-88975High 7.5
Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
Affected: fixed in 0.23.37; from 1.0.0-M1, fixed in 1.0.0-M48.
- CVE-2026-69206Medium 5.9
Http4s: DigestAuth allows replay of captured requests
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69202High 7.5
Http4s Ember HTTP/2: unbounded inbound body buffering
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69218High 7.5
Http4s Ember HTTP/2: unbounded continuation frame accumulation
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69203High 7.5
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69205High 8.7
Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69213High 7.5
Http4s Ember HTTP/2: unbounded outbound frame queue
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69216Medium 5.4
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-69204Critical 9.2
Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
Affected: fixed in 0.23.35; from 1.0.0-M1, fixed in 1.0.0-M47.
- CVE-2026-54556High 8.2
Http4s: HTTP/2 Denial of Service with Ember Backend
Affected: from 1.0.0-M1, fixed in 1.0.0-M47; fixed in 0.23.35.
- CVE-2025-59822Medium 6.3
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Affected: fixed in 0.23.31; from 1.0.0-M1, fixed in 1.0.0-M45.