CVE-2025-59822: Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-23 · updated 2026-10-19
Weakness: CWE-444

Description

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Affected products

http4s: before 0.23.31; 1.0.0-milestone1, 1.0.0-milestone10, 1.0.0-milestone11, 1.0.0-milestone12, 1.0.0-milestone13, 1.0.0-milestone14 (+38) — fixed in 0.23.31

How to fix

Upgrade to a fixed version: http4s 0.23.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59822 or the next vulnerability affects your stack