Http4s
8 CVEs across 2 Http4s products. Browse Http4s vulnerabilities, severities, and proof-of-concept exploits.
Http4s products with known CVEs
Http4s CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-73495 | High | 7.4 | 2026-08-12 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunk… |
CVE-2026-73493 | High | 7.5 | 2026-08-12 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragment… |
CVE-2025-59822 | High | 7.5 | 2025-09-23 | Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling… |
CVE-2023-22465 | High | 7.5 | 2023-01-04 | Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and… |
CVE-2021-41084 | High | 8.7 | 2021-09-21 | http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted… |
CVE-2021-39185 | Critical | 9.1 | 2021-09-01 | Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 thr… |
CVE-2021-32643 | Medium | 5.8 | 2021-05-27 | Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, an… |
CVE-2021-21294 | High | 7.5 | 2021-02-02 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnera… |
CVE-2021-21293 | High | 7.5 | 2021-02-02 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by… |
CVE-2020-5280 | High | 7.6 | 2020-03-25 | http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.stat… |