Vulnerabilities

TI-2025-37261 CVE-2025-59822 · GHSA-wcwh-7gfw-5wrr

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

MEDIUM 61

Http4s is a Scala interface for HTTP services.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00374 Published 2025-09-23 Fixed in 0.23.31, 1.0.0-M45 CWE-444

TI-2023-08714 CVE-2023-22465 · GHSA-54w6-vxfh-fw7f

HIGH 72

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00886 Published 2023-01-04 Fixed in 0.21.34, 0.22.15 +2 CWE-20

TI-2021-17927 CVE-2021-41084 · GHSA-5vcm-3xc3-w7x3

MEDIUM 40

http4s is an open source scala interface for HTTP.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01235 Published 2021-09-21 Fixed in 0.22.5, 0.23.4 +2 CWE-918

TI-2021-16571 CVE-2021-39185 · GHSA-52cf-226f-rhr6

MEDIUM 40

Http4s is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00594 Published 2021-09-01 Fixed in 0.21.27, 0.22.3 +1 CWE-346

TI-2021-12311 CVE-2021-32643 · GHSA-6h7w-fc84-x7p6

LOW 29

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01395 Published 2021-05-27 Fixed in 0.21.24, 1.0.0-M23 +2 CWE-22

TI-2021-04394 CVE-2021-21294 · GHSA-xhv5-w9c5-2r2w

LOW 37

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02172 Published 2021-02-02 Fixed in 0.21.17 CWE-400

TI-2020-04336 CVE-2020-5280 · GHSA-66q9-f7ff-mmx6

MEDIUM 43

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.06985 Published 2020-03-25 Fixed in 0.18.26, 0.20.20 +1 CWE-23