Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-69201Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Medium 5.9

In plain English

A medium-severity path traversal in http4s from http4s. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base when a directory-backed classpath is served and the backend preserves the encoded separator. The patch rejects decoded segments containing slash or backslash in ResourceService and WebjarService, and applies the same guard to the non-exploitable FileService for consistency. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.http4s:http4s-server_2.120.23.35GHSA-crq5-92j2-j7wv
Mavenorg.http4s:http4s-server_2.130.23.35GHSA-crq5-92j2-j7wv
Mavenorg.http4s:http4s-server_2.131.0.0-M47GHSA-crq5-92j2-j7wv
Mavenorg.http4s:http4s-server_30.23.35GHSA-crq5-92j2-j7wv
Mavenorg.http4s:http4s-server_31.0.0-M47GHSA-crq5-92j2-j7wv

Affected products (as reported)

VendorProductVersions
http4s http4s < 0.23.35>= 1.0.0-M1, < 1.0.0-M47

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References