HT
Product
http4s
20
CVEs
0
On KEV
9.2
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 7Low 0
Watch
Add http4s to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-69204 | 9.2 | Sep 15 | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69217 | 8.7 | Sep 15 | Http4s: Ember Server accepts duplicate Content-Length headers Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69205 | 8.7 | Sep 15 | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-54556 | 8.2 | Aug 26 | Http4s: HTTP/2 Denial of Service with Ember Backend Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M46 |
| CVE-2026-88975 | 7.5 | Sep 15 | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE Affected: < 0.23.37; >= 1.0.0-M1, < 1.0.0-M48 |
| CVE-2026-69202 | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded inbound body buffering Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69218 | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded continuation frame accumulation Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69203 | 7.5 | Sep 15 | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69210 | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69213 | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded outbound frame queue Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69209 | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts unbounded message sizes Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69208 | 7.5 | Sep 15 | Http4s: DigestAuth nonce map grows unbounded Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2025-59822 | 7.5 | Sep 23 | Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section Affected: < 0.23.31; >= 1.0.0-M1, < 1.0.0-M45 |
| CVE-2026-69215 | 6.8 | Sep 15 | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69214 | 6.8 | Sep 15 | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69206 | 5.9 | Sep 15 | Http4s: DigestAuth allows replay of captured requests Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69212 | 5.9 | Sep 15 | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69201 | 5.9 | Sep 15 | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69216 | 5.4 | Sep 15 | Http4s: Ember chunk parser lenience (TE.TE request smuggling) Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69211 | 4.8 | Sep 15 | Http4s: Set-Cookie rendering does not escape attribute delimiters Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
Showing 20