HT
Product
http4s
20
CVEs
0
On KEV
9.2
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 7Low 0
Watch
Add http4s to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-69215 | 6.8 | Sep 15 | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69214 | 6.8 | Sep 15 | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69206 | 5.9 | Sep 15 | Http4s: DigestAuth allows replay of captured requests Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69212 | 5.9 | Sep 15 | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69201 | 5.9 | Sep 15 | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69216 | 5.4 | Sep 15 | Http4s: Ember chunk parser lenience (TE.TE request smuggling) Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
| CVE-2026-69211 | 4.8 | Sep 15 | Http4s: Set-Cookie rendering does not escape attribute delimiters Affected: < 0.23.35; >= 1.0.0-M1, < 1.0.0-M47 |
Showing 7