Http4s vulnerabilities
31 CVEs and advisories name Http4s as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-61741http4s-scala-xml has an XML External Entity (XXE) processing issue
- CVE-2026-88975Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
- CVE-2026-69206Http4s: DigestAuth allows replay of captured requests
- CVE-2026-69202Http4s Ember HTTP/2: unbounded inbound body buffering
- CVE-2026-69218Http4s Ember HTTP/2: unbounded continuation frame accumulation
- CVE-2026-69203Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
- CVE-2026-69217Http4s: Ember Server accepts duplicate Content-Length headers
- CVE-2026-69210Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
- CVE-2026-69215Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
- CVE-2026-69205Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
- CVE-2026-69212Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
- CVE-2026-69213Http4s Ember HTTP/2: unbounded outbound frame queue
- CVE-2026-69214Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
- CVE-2026-69201Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
- CVE-2026-69216Http4s: Ember chunk parser lenience (TE.TE request smuggling)
- CVE-2026-69211Http4s: Set-Cookie rendering does not escape attribute delimiters
- CVE-2026-69209Http4s: WebSocket decoder accepts unbounded message sizes
- CVE-2026-69208Http4s: DigestAuth nonce map grows unbounded
- CVE-2026-69204Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
- CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
- CVE-2026-54556Http4s: HTTP/2 Denial of Service with Ember Backend
- CVE-2026-73495blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
- CVE-2026-73493http4s-blaze-server: Unbounded WebSocket message aggregation
- CVE-2025-59822Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
- CVE-2023-22465Http4s has fatal error parsing User-Agent and Server headers
- CVE-2021-41084Response Splitting from unsanitized headers in http4s
- CVE-2021-39185Default CORS config allows any origin with credentials
- CVE-2021-32643StaticFile.fromUrl can leak presence of a directory
- CVE-2021-21294Unbounded connection acceptance in http4s-blaze-server
- CVE-2021-21293Unbounded connection acceptance leads to file handle exhaustion