907 matches found
HTTP Request Smuggling
Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in...
io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)
org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: GHSA-MHVJ-JHPQ-885V...
io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)
org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: OSV:GHSA-MHVJ-JHPQ-885V...
ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +130 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-m1, <=0.23.17)
org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-m1, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m2, =0.5.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2026-73494 Source advisory: GHSA-MHVJ-JHPQ-885V...
io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by unknown CVE via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)
org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGHTTP4S-18313138...
PT-2026-67590
Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...
net.moznion:donovan (1.0.0), org.apache.tomcat:tomcat-catalina-ha (8.0.21) +6 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.21)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.moznion:donovan 1.0.0 - org.apache.tomcat:tomcat-catalina-ha 8.0.21 -...
net.moznion:donovan (1.0.0), org.apache.tomcat:tomcat-catalina-ha (8.0.21) +6 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.0.21)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.moznion:donovan 1.0.0 - org.apache.tomcat:tomcat-catalina-ha 8.0.21 -...
net.moznion:donovan (1.0.0), org.apache.tomcat:tomcat-catalina-ha (8.0.21) +6 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (8.0.21)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - net.moznion:donovan 1.0.0 - org.apache.tomcat:tomcat-catalina-ha 8.0.21 -...
com.brotherlogic.recordcollection:recordcollection (0.1), org.apache.tomcat:tomcat-catalina-ha (8.0.24) +6 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.24)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.brotherlogic.recordcollection:recordcollection 0.1 - org.apache.tomcat:tomcat-catalina-h...
org.apache.tomcat:tomcat-catalina-ha (8.0.37), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.37) +4 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.0.37)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.37 - org.apache.tomcat:tomcat-catalina-jmx-remote...
org.apache.tomcat:tomcat-catalina-ha (8.0.37), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.37) +4 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.37)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.37 - org.apache.tomcat:tomcat-catalina-jmx-remote...
org.apache.tomcat:tomcat-catalina-ha (8.0.44), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.44) +5 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.44)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.44 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.44 - org.apache.tomcat:tomcat-catalina-jmx-remote...
org.apache.tomcat:tomcat-catalina-ha (8.0.44), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.44) +5 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (8.0.44)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.44 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.44 - org.apache.tomcat:tomcat-catalina-jmx-remote...
org.apache.tomcat:tomcat-catalina-ha (8.0.44), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.44) +5 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (8.0.44)
org.apache.tomcat:tomcat-catalina MAVEN version 8.0.44 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.44 - org.apache.tomcat:tomcat-catalina-jmx-remote...
com.cloudera.oryx:oryx-lambda-serving (2.4.1), org.apache.tomcat:tomcat-catalina (8.5.15) +9 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (8.5.15)
org.apache.tomcat:tomcat-coyote MAVEN version 8.5.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - com.cloudera.oryx:oryx-lambda-serving 2.4.1 - org.apache.tomcat:tomcat-catalina 8.5.15 -...
CVE-2021-41084
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...
HTTP Request Smuggling
Http4s is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper handling of the HTTP trailer section, which allows an attacker—when the app is deployed behind a reverse proxy that forwards trailer headers—to bypass front-end security controls, target active users, and poison...
