Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

http4s — Vulnerabilities & Security Advisories 26

All 26 CVE vulnerabilities found in http4s, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security advisories and vulnerability data specifically for the http4s HTTP client and server library for the Scala programming language. The collection encompasses a wide spectrum of reported weaknesses, ranging from input validation flaws and information disclosure issues to potential denial of service vectors, covering the product's entire release history from its initial public launch through the most recent updates. Readers can utilize this resource to track the vendor's official security advisories over time, analyze the prevalence and characteristics of specific weakness classes within the http4s codebase, or review the complete vulnerability history for a particular version to assess legacy risk. The data presented here is derived from public security bulletins and standardized vulnerability databases, offering a consolidated view of known issues without including unverified reports or speculative threats. By examining the chronological distribution of these findings, security professionals and developers can identify recurring patterns in the library's security posture and make informed decisions regarding patch management and dependency updates. This aggregation serves as a central reference point for understanding the security evolution of http4s, enabling efficient risk assessment for projects relying on this critical networking component.

Vendor: http4s

CVE ID Title CVSS Severity Published
CVE-2026-88975 Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE CWE-400 7.5 High 2026-09-15
CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests CWE-294 5.9 Medium 2026-09-15
CVE-2026-69202 Http4s Ember HTTP/2: unbounded inbound body buffering CWE-400 7.5 High 2026-09-15
CVE-2026-69218 Http4s Ember HTTP/2: unbounded continuation frame accumulation CWE-770 7.5 High 2026-09-15
CVE-2026-69203 Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS CWE-400 7.5 High 2026-09-15
CVE-2026-69217 Http4s: Ember Server accepts duplicate Content-Length headers CWE-444 8.7 High 2026-09-15
CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop CWE-835 7.5 High 2026-09-15
CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin CWE-565 6.8 Medium 2026-09-15
CVE-2026-69205 Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) CWE-444 8.7 High 2026-09-15
CVE-2026-69212 Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect CWE-200 5.9 Medium 2026-09-15
CVE-2026-69213 Http4s Ember HTTP/2: unbounded outbound frame queue CWE-400 7.5 High 2026-09-15
CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain CWE-384 6.8 Medium 2026-09-15
CVE-2026-69201 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators CWE-22 5.9 Medium 2026-09-15
CVE-2026-69216 Http4s: Ember chunk parser lenience (TE.TE request smuggling) CWE-444 5.4 Medium 2026-09-15
CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters CWE-113 4.8 Medium 2026-09-15
CVE-2026-69209 Http4s: WebSocket decoder accepts unbounded message sizes CWE-400 7.5 High 2026-09-15
CVE-2026-69208 Http4s: DigestAuth nonce map grows unbounded CWE-400 7.5 High 2026-09-15
CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) CWE-444 9.2 Critical 2026-09-15
CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend CWE-409 8.2 High 2026-08-26
CVE-2025-59822 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CWE-444 6.5AI Medium AI 2025-09-23
CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers CWE-20 7.5 High 2023-01-04
CVE-2021-41084 Response Splitting from unsanitized headers in http4s CWE-918 8.7 High 2021-09-21
CVE-2021-39185 Default CORS config allows any origin with credentials CWE-346 9.1 Critical 2021-09-01
CVE-2021-32643 StaticFile.fromUrl can leak presence of a directory CWE-22 5.8 Medium 2021-05-27
CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server CWE-400 7.5 High 2021-02-02
CVE-2020-5280 Local file inclusion vulnerability in http4s CWE-23 7.6 High 2020-03-25

All 26 known CVE vulnerabilities affecting http4s with full Chinese analysis, references, and POCs where available.