http4s

Records37All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high23CVSS 7.0–8.9

Exploited now

http4s records in CISA KEV

No http4s vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Http4s 7 records HIGH Blaze 1 record LOW Fs2 1 record HIGH Grackle 1 record LOW Jawn 1 record HIGH

Records

37 records

TI-2022-13223 CVE-2022-31183 · GHSA-2cpx-6pqp-wf35

mTLS client verification is skipped in fs2 on Node.js

HIGH 82

fs2 is a compositional, streaming I/O library for Scala.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0083 Published 2022-08-01 Fixed in 3.2.11 CWE-295

TI-2023-08714 CVE-2023-22465 · GHSA-54w6-vxfh-fw7f

Http4s has fatal error parsing User-Agent and Server headers

HIGH 72

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00886 Published 2023-01-04 Fixed in 0.21.34, 0.22.15 +2 CWE-20

TI-2022-06031 CVE-2022-21653 · GHSA-vc89-hccf-rq55

Hash collision in typelevel jawn

HIGH 66

Jawn is an open source JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0082 Published 2022-01-05 Fixed in 1.3.2 CWE-400

TI-2025-37261 CVE-2025-59822 · GHSA-wcwh-7gfw-5wrr

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

MEDIUM 61

Http4s is a Scala interface for HTTP services.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00374 Published 2025-09-23 Fixed in 0.23.31, 1.0.0-M45 CWE-444

TI-2026-44185 CVE-2026-61741 · GHSA-cjx3-73hr-rpw7

http4s-scala-xml has an XML External Entity (XXE) processing issue

MEDIUM 46

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00294 Published 2026-09-24 Fixed in 0.24.1, 1.0.0-M39 CWE-611

TI-2020-04336 CVE-2020-5280 · GHSA-66q9-f7ff-mmx6

Local file inclusion vulnerability in http4s

MEDIUM 43

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.06985 Published 2020-03-25 Fixed in 0.18.26, 0.20.20 +1 CWE-23

TI-2026-48548 CVE-2026-69204 · GHSA-8h4c-x2wg-6xp8

Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

MEDIUM 42

Http4s is a Scala interface for HTTP services.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00574 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-39394 CVE-2026-54556 · GHSA-vmm3-xgcx-67hm

Http4s: HTTP/2 Denial of Service with Ember Backend

MEDIUM 42

Http4s is a Scala interface for HTTP services.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00524 Published 2026-08-26 Fixed in 0.23.35, 1.0.0-M46 +1 CWE-409

TI-2026-60307 CVE-2026-88975 · GHSA-gq9p-f254-h286

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.37, 1.0.0-M48 CWE-400

TI-2026-51605 CVE-2026-73493 · GHSA-7ppr-r889-mcf2

http4s-blaze-server: Unbounded WebSocket message aggregation

MEDIUM 40

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-08-12 Fixed in 0.23.18, 1.0.0-M42 CWE-770

TI-2026-48562 CVE-2026-69218 · GHSA-cp4q-fqw9-4hf6

Http4s Ember HTTP/2: unbounded continuation frame accumulation

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-770

TI-2026-48561 CVE-2026-69217

Http4s: Ember Server accepts duplicate Content-Length headers

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00499 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-48557 CVE-2026-69213 · GHSA-8f3q-3jmv-7prw

Http4s Ember HTTP/2: unbounded outbound frame queue

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48554 CVE-2026-69210

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-1284

TI-2026-48553 CVE-2026-69209

Http4s: WebSocket decoder accepts unbounded message sizes

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48552 CVE-2026-69208 · GHSA-fm4g-76c9-7w69

Http4s: DigestAuth nonce map grows unbounded

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00766 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48549 CVE-2026-69205 · GHSA-9998-894r-fwvr

Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.0048 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-48547 CVE-2026-69203 · GHSA-9vwc-pc8p-253q

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48546 CVE-2026-69202 · GHSA-6m4x-pp6q-5jmm

Http4s Ember HTTP/2: unbounded inbound body buffering

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-44239 CVE-2026-61814 · GHSA-w4cm-gvhj-cgw6

Jawn: Quadratic parsing effort in AsyncParser

MEDIUM 40

Jawn is an open source JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-09-23 Fixed in 1.7.0 CWE-400

TI-2026-42774 CVE-2026-59990 · GHSA-cc4v-rvgp-2pf3

Jawn: Uncontrolled nesting depth in JSON parser

MEDIUM 40

Jawn is an open source JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-09-23 Fixed in 1.7.0 CWE-770

TI-2021-17927 CVE-2021-41084 · GHSA-5vcm-3xc3-w7x3

Response Splitting from unsanitized headers in http4s

MEDIUM 40

http4s is an open source scala interface for HTTP.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01235 Published 2021-09-21 Fixed in 0.22.5, 0.23.4 +2 CWE-918

TI-2021-16571 CVE-2021-39185 · GHSA-52cf-226f-rhr6

Default CORS config allows any origin with credentials

MEDIUM 40

Http4s is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00594 Published 2021-09-01 Fixed in 0.21.27, 0.22.3 +1 CWE-346

TI-2021-04394 CVE-2021-21294 · GHSA-xhv5-w9c5-2r2w

Unbounded connection acceptance in http4s-blaze-server

LOW 37

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02172 Published 2021-02-02 Fixed in 0.21.17 CWE-400

TI-2021-04393 CVE-2021-21293 · GHSA-xmw9-q7x9-j5qc

Unbounded connection acceptance leads to file handle exhaustion

LOW 37

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02143 Published 2021-02-02 Fixed in 0.14.15 CWE-400

Open these records in search →

Critical	4
High	23
Medium	10
Low	0
No CVSS	0