CVE-2026-69212— Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Quick assessment
Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Http4s 是一个用于 HTTP 服务的 Scala 接口。在 0.23.35 和 1.0.0-M47 之前的版本中，FollowRedirect 客户端中间件仅在重定向改变主机名（authority）时，才会剥离（移除）Authorization 和 Cookie 请求头。然而，其主机名比较逻辑并未包含 URI 的协议部分（scheme）。因此，从 HTTPS 到 HTTP 的同主机重定向会保留这些凭证信息，并通过明文连接传输它们。能够诱发该降级并监控网络流量的攻击者，可以捕获使用 FollowRedirect
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69212
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP therefore preserves credentials and transmits them over a plaintext connection. An attacker who can induce the downgrade and observe the network can capture those sensitive headers from applications using FollowRedirect. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69212
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69212
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69212 (1)
Vendor Advisories for CVE-2026-69212 (1)
Vendor Pages for CVE-2026-69212 (2)
Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total
| CVE-2026-69204 | 9.2 CRITICAL | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl |
| CVE-2026-69217 | 8.7 HIGH | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69205 | 8.7 HIGH | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-69208 | 7.5 HIGH | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-88975 | 7.5 HIGH | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME |
| CVE-2026-69202 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69210 | 7.5 HIGH | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69213 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69203 | 7.5 HIGH | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69209 | 7.5 HIGH | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69214 | 6.8 MEDIUM | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69215 | 6.8 MEDIUM | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69201 | 5.9 MEDIUM | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69206 | 5.9 MEDIUM | Http4s: DigestAuth allows replay of captured requests |
| CVE-2026-69216 | 5.4 MEDIUM | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | 4.8 MEDIUM | Http4s: Set-Cookie rendering does not escape attribute delimiters |
IV. Related Vulnerabilities
Same product: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same vendor: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same weakness: CWE-200
-
CVE-2026-88065
`tts-be` application has a Broken Access Control vulnerabili -
CVE-2026-54689
mcp-searxng hardened-mode SSRF bypasses permit internal URL -
CVE-2026-91992
Tornado before 6.5.7 Credential Leak via Handle Reuse -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
V. Comments for CVE-2026-69212
No comments yet