Vulnerabilities

TI-2026-44185 CVE-2026-61741 · GHSA-cjx3-73hr-rpw7

http4s-scala-xml has an XML External Entity (XXE) processing issue

MEDIUM 46

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00294 Published 2026-09-24 Fixed in 0.24.1, 1.0.0-M39 CWE-611

TI-2026-42774 CVE-2026-59990 · GHSA-cc4v-rvgp-2pf3

Jawn: Uncontrolled nesting depth in JSON parser

MEDIUM 40

Jawn is an open source JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-09-23 Fixed in 1.7.0 CWE-770

TI-2026-44239 CVE-2026-61814 · GHSA-w4cm-gvhj-cgw6

Jawn: Quadratic parsing effort in AsyncParser

MEDIUM 40

Jawn is an open source JSON parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-09-23 Fixed in 1.7.0 CWE-400

TI-2026-60307 CVE-2026-88975 · GHSA-gq9p-f254-h286

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.37, 1.0.0-M48 CWE-400

TI-2026-48550 CVE-2026-69206 · GHSA-9xww-74xv-gjfp

Http4s: DigestAuth allows replay of captured requests

LOW 27

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00395 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-294

TI-2026-48546 CVE-2026-69202 · GHSA-6m4x-pp6q-5jmm

Http4s Ember HTTP/2: unbounded inbound body buffering

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48562 CVE-2026-69218 · GHSA-cp4q-fqw9-4hf6

Http4s Ember HTTP/2: unbounded continuation frame accumulation

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-770

TI-2026-48547 CVE-2026-69203 · GHSA-9vwc-pc8p-253q

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48561 CVE-2026-69217

Http4s: Ember Server accepts duplicate Content-Length headers

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00499 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-48554 CVE-2026-69210

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-1284

TI-2026-48559 CVE-2026-69215 · GHSA-grh8-3p95-f9rr

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

LOW 31

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00505 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-1275

TI-2026-48549 CVE-2026-69205 · GHSA-9998-894r-fwvr

Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.0048 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-48556 CVE-2026-69212

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

LOW 26

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00279 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-200

TI-2026-48557 CVE-2026-69213 · GHSA-8f3q-3jmv-7prw

Http4s Ember HTTP/2: unbounded outbound frame queue

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48558 CVE-2026-69214 · GHSA-wv64-j4fq-5f9x

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

LOW 30

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00395 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-384

TI-2026-48545 CVE-2026-69201 · GHSA-crq5-92j2-j7wv

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

LOW 28

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00758 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-22

TI-2026-48560 CVE-2026-69216 · GHSA-jrpm-956j-96jg

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

LOW 25

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00368 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-48555 CVE-2026-69211

Http4s: Set-Cookie rendering does not escape attribute delimiters

LOW 22

Http4s is a Scala interface for HTTP services.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00326 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-113

TI-2026-48553 CVE-2026-69209

Http4s: WebSocket decoder accepts unbounded message sizes

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48552 CVE-2026-69208 · GHSA-fm4g-76c9-7w69

Http4s: DigestAuth nonce map grows unbounded

MEDIUM 40

Http4s is a Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00766 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-400

TI-2026-48548 CVE-2026-69204 · GHSA-8h4c-x2wg-6xp8

Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

MEDIUM 42

Http4s is a Scala interface for HTTP services.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00574 Published 2026-09-15 Fixed in 0.23.35, 1.0.0-M47 CWE-444

TI-2026-51606 CVE-2026-73494 · GHSA-mhvj-jhpq-885v

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

LOW 35

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00628 Published 2026-09-14 Fixed in 0.23.18, 1.0.0-M42 CWE-444

TI-2026-39394 CVE-2026-54556 · GHSA-vmm3-xgcx-67hm

Http4s: HTTP/2 Denial of Service with Ember Backend

MEDIUM 42

Http4s is a Scala interface for HTTP services.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00524 Published 2026-08-26 Fixed in 0.23.35, 1.0.0-M46 +1 CWE-409

TI-2026-51607 CVE-2026-73495 · GHSA-46q4-43ph-c6fr

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

LOW 35

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0048 Published 2026-08-12 Fixed in 0.23.18, 1.0.0-M42 CWE-444

TI-2026-51605 CVE-2026-73493 · GHSA-7ppr-r889-mcf2

http4s-blaze-server: Unbounded WebSocket message aggregation

MEDIUM 40

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-08-12 Fixed in 0.23.18, 1.0.0-M42 CWE-770

Vulnerabilities

Filters