HT
Vendor
http4s
24
CVEs
0
On KEV
0
New 30D
Products
HT9.2
http4s
http4s
20 CVEs0 on KEV0 new
BL7.5
blaze
http4s
3 CVEs0 on KEV0 new
HT9.3
http4s-scala-xml
http4s
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-61741 | HT http4s-scala-xml http4s | 9.3 | Sep 24 | http4s-scala-xml has an XML External Entity (XXE) processing issue |
| CVE-2026-88975 | HT http4s http4s | 7.5 | Sep 15 | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE |
| CVE-2026-69206 | HT http4s http4s | 5.9 | Sep 15 | Http4s: DigestAuth allows replay of captured requests |
| CVE-2026-69202 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69203 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69217 | HT http4s http4s | 8.7 | Sep 15 | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69210 | HT http4s http4s | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69215 | HT http4s http4s | 6.8 | Sep 15 | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69205 | HT http4s http4s | 8.7 | Sep 15 | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-69212 | HT http4s http4s | 5.9 | Sep 15 | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect |
| CVE-2026-69213 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69214 | HT http4s http4s | 6.8 | Sep 15 | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69201 | HT http4s http4s | 5.9 | Sep 15 | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69216 | HT http4s http4s | 5.4 | Sep 15 | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | HT http4s http4s | 4.8 | Sep 15 | Http4s: Set-Cookie rendering does not escape attribute delimiters |
| CVE-2026-69209 | HT http4s http4s | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69208 | HT http4s http4s | 7.5 | Sep 15 | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-69204 | HT http4s http4s | 9.2 | Sep 15 | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) |
| CVE-2026-73494 | BL blaze http4s | 7.4 | Sep 14 | blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser |
| CVE-2026-54556 | HT http4s http4s | 8.2 | Aug 26 | Http4s: HTTP/2 Denial of Service with Ember Backend |
| CVE-2026-73495 | BL blaze http4s | 7.4 | Aug 12 | blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) |
| CVE-2026-73493 | BL blaze http4s | 7.5 | Aug 12 | http4s-blaze-server: Unbounded WebSocket message aggregation |
| CVE-2025-59822 | HT http4s http4s | 7.5 | Sep 23 | Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section |