# cve.now: Http4s

The newest entries naming Http4s as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61741](https://cve.now/CVE-2026-61741.md): http4s-scala-xml has an XML External Entity (XXE) processing issue (CVSS 9.3)
- [CVE-2026-88975](https://cve.now/CVE-2026-88975.md): Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS\_MAX\_FRAME\_SIZE (CVSS 7.5)
- [CVE-2026-69206](https://cve.now/CVE-2026-69206.md): Http4s: DigestAuth allows replay of captured requests (CVSS 5.9)
- [CVE-2026-69202](https://cve.now/CVE-2026-69202.md): Http4s Ember HTTP/2: unbounded inbound body buffering (CVSS 7.5)
- [CVE-2026-69218](https://cve.now/CVE-2026-69218.md): Http4s Ember HTTP/2: unbounded continuation frame accumulation (CVSS 7.5)
- [CVE-2026-69203](https://cve.now/CVE-2026-69203.md): Http4s Ember HTTP/2: does not enforce SETTINGS\_MAX\_CONCURRENT\_STREAMS (CVSS 7.5)
- [CVE-2026-69217](https://cve.now/CVE-2026-69217.md): Http4s: Ember Server accepts duplicate Content-Length headers (CVSS 8.7)
- [CVE-2026-69210](https://cve.now/CVE-2026-69210.md): Http4s: WebSocket decoder accepts negative length, causing infinite decode loop (CVSS 7.5)
- [CVE-2026-69215](https://cve.now/CVE-2026-69215.md): Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (CVSS 6.8)
- [CVE-2026-69205](https://cve.now/CVE-2026-69205.md): Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (CVSS 8.7)
- [CVE-2026-69212](https://cve.now/CVE-2026-69212.md): Http4s: FollowRedirect middleware leaks credentials over https-\>http same-authority redirect (CVSS 5.9)
- [CVE-2026-69213](https://cve.now/CVE-2026-69213.md): Http4s Ember HTTP/2: unbounded outbound frame queue (CVSS 7.5)
- [CVE-2026-69214](https://cve.now/CVE-2026-69214.md): Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (CVSS 6.8)
- [CVE-2026-69201](https://cve.now/CVE-2026-69201.md): Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (CVSS 5.9)
- [CVE-2026-69216](https://cve.now/CVE-2026-69216.md): Http4s: Ember chunk parser lenience (TE.TE request smuggling) (CVSS 5.4)
- [CVE-2026-69211](https://cve.now/CVE-2026-69211.md): Http4s: Set-Cookie rendering does not escape attribute delimiters (CVSS 4.8)
- [CVE-2026-69209](https://cve.now/CVE-2026-69209.md): Http4s: WebSocket decoder accepts unbounded message sizes (CVSS 7.5)
- [CVE-2026-69208](https://cve.now/CVE-2026-69208.md): Http4s: DigestAuth nonce map grows unbounded (CVSS 7.5)
- [CVE-2026-69204](https://cve.now/CVE-2026-69204.md): Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (CVSS 9.2)
- [CVE-2026-73494](https://cve.now/CVE-2026-73494.md): blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser (CVSS 7.4)
- [CVE-2026-54556](https://cve.now/CVE-2026-54556.md): Http4s: HTTP/2 Denial of Service with Ember Backend (CVSS 8.2)
- [CVE-2026-73495](https://cve.now/CVE-2026-73495.md): blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) (CVSS 7.4)
- [CVE-2026-73493](https://cve.now/CVE-2026-73493.md): http4s-blaze-server: Unbounded WebSocket message aggregation (CVSS 7.5)
- [CVE-2025-59822](https://cve.now/CVE-2025-59822.md): Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section (CVSS 6.3)
- [CVE-2023-22465](https://cve.now/CVE-2023-22465.md): Http4s has fatal error parsing User-Agent and Server headers (CVSS 7.5)
- [CVE-2021-41084](https://cve.now/CVE-2021-41084.md): Response Splitting from unsanitized headers in http4s (CVSS 8.7)
- [CVE-2021-39185](https://cve.now/CVE-2021-39185.md): Default CORS config allows any origin with credentials (CVSS 9.1)
- [CVE-2021-32643](https://cve.now/CVE-2021-32643.md): StaticFile.fromUrl can leak presence of a directory (CVSS 5.8)
- [CVE-2021-21294](https://cve.now/CVE-2021-21294.md): Unbounded connection acceptance in http4s-blaze-server (CVSS 7.5)
- [CVE-2021-21293](https://cve.now/CVE-2021-21293.md): Unbounded connection acceptance leads to file handle exhaustion (CVSS 7.5)
- [CVE-2020-5280](https://cve.now/CVE-2020-5280.md): Local file inclusion vulnerability in http4s (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/http4s
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.