Hhttp4s

Products

Exploited and recent CVEs

• CVE-2026-61741 Critical 9.3 http4s-scala-xml has an XML External Entity (XXE) processing issue 0.3%
• CVE-2026-88975 High 7.5 Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE 0.6%
• CVE-2026-69206 Medium 5.9 Http4s: DigestAuth allows replay of captured requests 0.4%
• CVE-2026-69202 High 7.5 Http4s Ember HTTP/2: unbounded inbound body buffering 0.6%
• CVE-2026-69218 High 7.5 Http4s Ember HTTP/2: unbounded continuation frame accumulation 0.6%
• CVE-2026-69203 High 7.5 Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS 0.6%
• CVE-2026-69217 High 8.7 Http4s: Ember Server accepts duplicate Content-Length headers 0.5%
• CVE-2026-69210 High 7.5 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop 0.6%
• CVE-2026-69215 Medium 6.8 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin 0.5%
• CVE-2026-69205 High 8.7 Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) 0.5%
• CVE-2026-69212 Medium 5.9 Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect 0.3%
• CVE-2026-69213 High 7.5 Http4s Ember HTTP/2: unbounded outbound frame queue 0.6%
• CVE-2026-69214 Medium 6.8 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain 0.4%
• CVE-2026-69201 Medium 5.9 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators 0.8%
• CVE-2026-69216 Medium 5.4 Http4s: Ember chunk parser lenience (TE.TE request smuggling) 0.4%
• CVE-2026-69211 Medium 4.8 Http4s: Set-Cookie rendering does not escape attribute delimiters 0.3%
• CVE-2026-69209 High 7.5 Http4s: WebSocket decoder accepts unbounded message sizes 0.6%
• CVE-2026-69208 High 7.5 Http4s: DigestAuth nonce map grows unbounded 0.8%
• CVE-2026-69204 Critical 9.2 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) 0.6%
• CVE-2026-73494 High 7.4 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser 0.6%
• CVE-2026-54556 High 8.2 Http4s: HTTP/2 Denial of Service with Ember Backend 0.5%
• CVE-2026-73495 High 7.4 blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) 0.5%
• CVE-2026-73493 High 7.5 http4s-blaze-server: Unbounded WebSocket message aggregation 0.6%
• CVE-2025-59822 Medium 6.3 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section 0.4%
• CVE-2023-22465 High 7.5 Http4s has fatal error parsing User-Agent and Server headers 0.9%
• CVE-2021-41084 High 8.7 Response Splitting from unsanitized headers in http4s 1.2%
• CVE-2021-39185 Critical 9.1 Default CORS config allows any origin with credentials 0.6%
• CVE-2021-32643 Medium 5.8 StaticFile.fromUrl can leak presence of a directory 1.4%
• CVE-2021-21294 High 7.5 Unbounded connection acceptance in http4s-blaze-server 2.2%
• CVE-2021-21293 High 7.5 Unbounded connection acceptance leads to file handle exhaustion 2.1%