HTTP Request/response Smuggling

Http4s is vulnerable to HTTP request/response smuggling. The vulnerability is due to Ember’s chunk decoder accepting malformed chunk-size values with leading plus or minus signs, which allows an attacker to exploit differences in chunk-boundary parsing by intermediaries to bypass controls, poison...

HTTP Request Smuggling

Http4s is vulnerable to HTTP request smuggling. The vulnerability is due to case-sensitive and charset-dependent parsing of the Transfer-Encoding header in Ember, which allows an attacker to exploit discrepancies between Ember and RFC-compliant intermediaries to bypass access controls, hijack...

HTTP Request Smuggling

Http4s is vulnerable to HTTP Request Smuggling. The vulnerability is due to inconsistent HTTP message body framing between Ember and an intermediary when both headers are present, which allows an attacker to smuggle a second request, bypass access controls, poison caches, or cause a victim reques...

ai.starlake:quack-on-demand_3 (>=0.1.0, <=0.4.0), com.47deg:energy-monitor-persistence-app_3 (0.2.0) +198 more potentially affected by CVE-2026-88975 via org.http4s:http4s-ember-core_3 (>=0.22.0-m8, <=0.23.36)

org.http4s:http4s-ember-core3 MAVEN version =0.22.0-m8, =0.1.0, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =1.0.0, =0.0.0-3-cca5341b, =7.1.0, =7.1.1 and more Source cves: CVE-2026-88975 Source advisory: SNYK:JAVA-ORGHTTP4S-19869286...

com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +71 more potentially affected by CVE-2026-88975 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.36)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2026-88975 Source advisory: SNYK:JAVA-ORGHTTP4S-19869...

dev.i10416:slackapis-core_3 (>=0.0.1, <=0.0.2), es.weso:schema_3 (>=0.1.103, <=0.2.4) +23 more potentially affected by CVE-2026-88975 via org.http4s:http4s-ember-core_3 (>=1.0.0-m22, <=1.0.0-m47)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-m22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =1.0.0-rc5 - io.github.linyxus:papiers-core3 0.2.0 - io.github.torrentdam.server:server3 4.0.0 and more Source cves: CVE-2026-8897...

co.topl:bifrost-daml-broker_2.13 (1.0.0.beta-2), co.topl:brambl-cli_2.13 (>=2.0.0-beta1, <=2.0.0-beta6) +127 more potentially affected by CVE-2026-88975 via org.http4s:http4s-ember-core_2.13 (>=0.10.0-m10, <=0.23.36)

org.http4s:http4s-ember-core2.13 MAVEN version =0.10.0-m10, =2.0.0-beta1, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.1.0, =0.21.0, =0.24.0 and more Source cves: CVE-2026-88975 Source advisory: SNYK:JAVA-ORGHTTP4S-19869288...

dev.i10416:slackapis-core_2.13 (>=0.0.1, <=0.0.2), es.weso:rdfshape-server_2.13 (>=0.0.73, <=0.2.14) +16 more potentially affected by CVE-2026-88975 via org.http4s:http4s-ember-core_2.13 (>=1.0.0-m2, <=1.0.0-m47)

org.http4s:http4s-ember-core2.13 MAVEN version =1.0.0-m2, =0.0.1, =0.0.73, =0.1.90, =0.1.90, =0.1.90, =0.1.91, =0.1.109, =0.1.91, =0.1.101, =0.0.82, =0.1.91, =0.1.0, =2.1.0, =2.1.0, =2.2.2 and more Source cves: CVE-2026-88975 Source advisory: SNYK:JAVA-ORGHTTP4S-19869288...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

io.jobial:scase-http4s_2.13 (>=2.1.0, <=2.2.2), io.jobial:scase_2.13 (>=2.1.0, <=2.2.2) +1 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_2.13 (>=1.0.0-m30, <=1.0.0-m37)

org.http4s:http4s-ember-server2.13 MAVEN version =1.0.0-m30, =2.1.0, =2.1.0, =2.2.2 - io.taig:taigless-storage-http4s-server2.13 0.15.0 Source cves: CVE-2026-69209 Source advisory: SNYK:JAVA-ORGHTTP4S-19851898...

ai.starlake:quack-on-demand_3 (>=0.1.0, <=0.4.0), com.47deg:energy-monitor-persistence-app_3 (0.2.0) +88 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_3 (>=0.22.14, <=0.23.34)

org.http4s:http4s-ember-server3 MAVEN version =0.22.14, =0.1.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =0.0.0-3-cca5341b, =7.1.0, =0.22.0, =1.9.3, =2.0.0, =2.0.0, =6.9.0, =1.0.0, =5.0.0 and more Source cves: CVE-2026-69209 Source advisory: SNYK:JAVA-ORGHTTP4S-19851899...

io.getkyo:kyo-bench_3 (>=1.0.0-rc2, <=1.0.0-rc5), io.github.linyxus:papiers-core_3 (0.2.0) +6 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_3 (>=1.0.0-m29, <=1.0.0-m46)

org.http4s:http4s-ember-server3 MAVEN version =1.0.0-m29, =1.0.0-rc2, =0.10.0, =0.1, =0.1, =0.9.0, =0.10.1 Source cves: CVE-2026-69209 Source advisory: SNYK:JAVA-ORGHTTP4S-19851899...

com.avast:sst-bundle-monix-http4s-ember_2.12 (>=0.17.0, <=0.19.3), com.avast:sst-bundle-zio-http4s-ember_2.12 (>=0.17.0, <=0.19.3) +25 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_2.12 (>=0.22.8, <=0.23.31)

org.http4s:http4s-ember-server2.12 MAVEN version =0.22.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.20.4, =1.6.29, =1.6.29, =1.6.29, =0.8.0-rab.1, =0.1.0-m6, =0.25.0 and more Source cves: CVE-2026-69209 Source advisory: SNYK:JAVA-ORGHTTP4S-19851897...

co.topl:brambl-cli_2.13 (>=2.0.0-beta1, <=2.0.0-beta6), com.47deg:energy-monitor-persistence-app_2.13 (0.2.0) +72 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_2.13 (>=0.22.8, <=0.23.34)

org.http4s:http4s-ember-server2.13 MAVEN version =0.22.8, =2.0.0-beta1, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.1.0, =0.20.4, =0.0.1, =1.0.0, =1.0.0, =5.0.0 - com.snowplowanalytics:loaders-common2.13 0.1.0-m5 and more Source cves: CVE-2026-69209 Source...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

dev.i10416:slackapis-core_3 (>=0.0.1, <=0.0.2), es.weso:schema_3 (>=0.1.103, <=0.2.4) +23 more potentially affected by CVE-2026-69213 via org.http4s:http4s-ember-core_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-m22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =1.0.0-rc5 - io.github.linyxus:papiers-core3 0.2.0 - io.github.torrentdam.server:server3 4.0.0 and more Source cves: CVE-2026-6921...