What’s Vulnerable › Products

http4s vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your http4s version is affected

Latest http4s vulnerabilities

• CVE-2026-88975 — Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE (CVSS 7.5)
• CVE-2026-69218 — Http4s Ember HTTP/2: unbounded continuation frame accumulation (CVSS 7.5)
• CVE-2026-69217 — Http4s: Ember Server accepts duplicate Content-Length headers (CVSS 8.7)
• CVE-2026-69215 — Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (CVSS 6.8)
• CVE-2026-69210 — Http4s: WebSocket decoder accepts negative length, causing infinite decode loop (CVSS 7.5)
• CVE-2026-69206 — Http4s: DigestAuth allows replay of captured requests (CVSS 5.9)
• CVE-2026-69205 — Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (CVSS 8.7)
• CVE-2026-69203 — Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS (CVSS 7.5)
• CVE-2026-69202 — Http4s Ember HTTP/2: unbounded inbound body buffering (CVSS 7.5)
• CVE-2026-69216 — Http4s: Ember chunk parser lenience (TE.TE request smuggling) (CVSS 5.4)
• CVE-2026-69214 — Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (CVSS 6.8)
• CVE-2026-69213 — Http4s Ember HTTP/2: unbounded outbound frame queue (CVSS 7.5)
• CVE-2026-69212 — Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect (CVSS 5.9)
• CVE-2026-69211 — Http4s: Set-Cookie rendering does not escape attribute delimiters (CVSS 4.8)
• CVE-2026-69209 — Http4s: WebSocket decoder accepts unbounded message sizes (CVSS 7.5)
• CVE-2026-69208 — Http4s: DigestAuth nonce map grows unbounded (CVSS 7.5)
• CVE-2026-69204 — Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (CVSS 9.2)
• CVE-2026-69201 — Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (CVSS 5.9)
• CVE-2026-54556 — Http4s: HTTP/2 Denial of Service with Ember Backend (CVSS 8.2)
• CVE-2025-59822 — Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section (CVSS 7.5)
• CVE-2023-22465 — Http4s has fatal error parsing User-Agent and Server headers (CVSS 5.3)
• CVE-2021-41084 — Response Splitting from unsanitized headers in http4s (CVSS 4.7)
• CVE-2021-39185 — Default CORS config allows any origin with credentials (CVSS 6.4)
• CVE-2021-32643 — StaticFile.fromUrl can leak presence of a directory (CVSS 5.8)
• CVE-2021-21294 — Unbounded connection acceptance in http4s-blaze-server (CVSS 7.5)