Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Priority MEDIUM 61CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed http4s (http4s): 0.23.31, 1.0.0-M45org.http4s:http4s-ember-core_2.12 (Maven): 0.23.31+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | http4s | before 0.23.31; 1.0.0-M1 to before 1.0.0-M45 | 0.23.31, 1.0.0-M45 | Patch available | CNA |
| — | org.http4s:http4s-ember-core_2.12 (Maven) | before 0.23.31 | 0.23.31 | Patch available | GHSA-wcwh-7gfw-5wrr |
| — | org.http4s:http4s-ember-core_2.13 (Maven) | before 0.23.31 | 0.23.31 | Patch available | GHSA-wcwh-7gfw-5wrr |
| — | org.http4s:http4s-ember-core_3 (Maven) | before 0.23.31 | 0.23.31 | Patch available | GHSA-wcwh-7gfw-5wrr |
| — | org.http4s:http4s-ember-core_2.13 (Maven) | 1.0.0-M1 to before 1.0.0-M45 | 1.0.0-M45 | Patch available | GHSA-wcwh-7gfw-5wrr |
| — | org.http4s:http4s-ember-core_3 (Maven) | 1.0.0-M1 to before 1.0.0-M45 | 1.0.0-M45 | Patch available | GHSA-wcwh-7gfw-5wrr |
- http4s Vendorhttp4s Affected before 0.23.31; 1.0.0-M1 to before 1.0.0-M45 Fixed in 0.23.31, 1.0.0-M45 Patch available CNA
- org.http4s:http4s-ember-core_2.12 (Maven) Vendor— Affected before 0.23.31 Fixed in 0.23.31 Patch available GHSA-wcwh-7gfw-5wrr
- org.http4s:http4s-ember-core_2.13 (Maven) Vendor— Affected before 0.23.31 Fixed in 0.23.31 Patch available GHSA-wcwh-7gfw-5wrr
- org.http4s:http4s-ember-core_3 (Maven) Vendor— Affected before 0.23.31 Fixed in 0.23.31 Patch available GHSA-wcwh-7gfw-5wrr
- org.http4s:http4s-ember-core_2.13 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M45 Fixed in 1.0.0-M45 Patch available GHSA-wcwh-7gfw-5wrr
- org.http4s:http4s-ember-core_3 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M45 Fixed in 1.0.0-M45 Patch available GHSA-wcwh-7gfw-5wrr
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* | before 0.23.31 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* | 1.0.0 milestone1 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* | 1.0.0 milestone10 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* | 1.0.0 milestone11 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* | 1.0.0 milestone12 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* | 1.0.0 milestone13 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* | 1.0.0 milestone14 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* | 1.0.0 milestone15 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* | 1.0.0 milestone16 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* | 1.0.0 milestone17 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions before 0.23.31 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* Versions 1.0.0 milestone1 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* Versions 1.0.0 milestone10 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* Versions 1.0.0 milestone11 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* Versions 1.0.0 milestone12 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* Versions 1.0.0 milestone13 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* Versions 1.0.0 milestone14 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* Versions 1.0.0 milestone15 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* Versions 1.0.0 milestone16 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* Versions 1.0.0 milestone17 Vulnerable ·http4s
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* | 1.0.0 milestone18 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* | 1.0.0 milestone19 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* | 1.0.0 milestone2 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* | 1.0.0 milestone20 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* | 1.0.0 milestone21 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* | 1.0.0 milestone22 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:* | 1.0.0 milestone23 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:* | 1.0.0 milestone24 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:* | 1.0.0 milestone25 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:* | 1.0.0 milestone26 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:* | 1.0.0 milestone27 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:* | 1.0.0 milestone28 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:* | 1.0.0 milestone29 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* | 1.0.0 milestone3 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:* | 1.0.0 milestone30 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:* | 1.0.0 milestone31 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:* | 1.0.0 milestone32 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:* | 1.0.0 milestone33 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:* | 1.0.0 milestone34 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:* | 1.0.0 milestone35 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:* | 1.0.0 milestone36 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:* | 1.0.0 milestone37 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:* | 1.0.0 milestone38 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:* | 1.0.0 milestone39 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* | 1.0.0 milestone4 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:* | 1.0.0 milestone40 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:* | 1.0.0 milestone41 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:* | 1.0.0 milestone42 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:* | 1.0.0 milestone43 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:* | 1.0.0 milestone44 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* | 1.0.0 milestone5 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* | 1.0.0 milestone6 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* | 1.0.0 milestone7 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* | 1.0.0 milestone8 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* | 1.0.0 milestone9 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* Versions 1.0.0 milestone18 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* Versions 1.0.0 milestone19 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* Versions 1.0.0 milestone2 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* Versions 1.0.0 milestone20 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* Versions 1.0.0 milestone21 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* Versions 1.0.0 milestone22 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:* Versions 1.0.0 milestone23 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:* Versions 1.0.0 milestone24 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:* Versions 1.0.0 milestone25 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:* Versions 1.0.0 milestone26 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:* Versions 1.0.0 milestone27 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:* Versions 1.0.0 milestone28 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:* Versions 1.0.0 milestone29 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* Versions 1.0.0 milestone3 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:* Versions 1.0.0 milestone30 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:* Versions 1.0.0 milestone31 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:* Versions 1.0.0 milestone32 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:* Versions 1.0.0 milestone33 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:* Versions 1.0.0 milestone34 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:* Versions 1.0.0 milestone35 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:* Versions 1.0.0 milestone36 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:* Versions 1.0.0 milestone37 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:* Versions 1.0.0 milestone38 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:* Versions 1.0.0 milestone39 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* Versions 1.0.0 milestone4 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:* Versions 1.0.0 milestone40 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:* Versions 1.0.0 milestone41 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:* Versions 1.0.0 milestone42 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:* Versions 1.0.0 milestone43 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:* Versions 1.0.0 milestone44 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* Versions 1.0.0 milestone5 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* Versions 1.0.0 milestone6 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* Versions 1.0.0 milestone7 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* Versions 1.0.0 milestone8 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* Versions 1.0.0 milestone9 Vulnerable ·http4s
Remediation
- Fix · CNA http4s (http4s) Fixed in 0.23.31, 1.0.0-M45
- Fix · GHSA-wcwh-7gfw-5wrr org.http4s:http4s-ember-core_2.12 (Maven) Fixed in 0.23.31 Advisory →
- Fix · GHSA-wcwh-7gfw-5wrr org.http4s:http4s-ember-core_2.13 (Maven) Fixed in 0.23.31 Advisory →
- Fix · GHSA-wcwh-7gfw-5wrr org.http4s:http4s-ember-core_3 (Maven) Fixed in 0.23.31 Advisory →
- Fix · GHSA-wcwh-7gfw-5wrr org.http4s:http4s-ember-core_2.13 (Maven) Fixed in 1.0.0-M45 Advisory →
- Fix · GHSA-wcwh-7gfw-5wrr org.http4s:http4s-ember-core_3 (Maven) Fixed in 1.0.0-M45 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59822
- 2026-10-03 Alias added: GHSA-wcwh-7gfw-5wrr
References
More Http4s vulnerabilities
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
- TI-2021-17927 Response Splitting from unsanitized headers in http4s CVSS 3.1HIGH 8.7
- TI-2021-16571 Default CORS config allows any origin with credentials CVSS 3.1CRITICAL 9.1
- TI-2021-04394 Unbounded connection acceptance in http4s-blaze-server CVSS 3.1HIGH 7.5
- TI-2021-12311 StaticFile.fromUrl can leak presence of a directory CVSS 3.1MEDIUM 5.8
Sources
- CVE-2025-59822 · CVE Program
- CVE-2025-59822 · NVD
- FIRST EPSS
- GHSA-wcwh-7gfw-5wrr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences