com.qvantel:jsonapi-scala-http4s-client_2.12 (>=6.0.1, <=6.1.0), org.aws4s:aws4s_2.12 (>=0.2.0, <=0.5.0) +22 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.0-m9)

co.fs2:fs2-io2.12 MAVEN version 0.10.0-m9 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.12 =6.0.1, =0.2.0, =0.5.0 - org.http4s:http4s-argonaut2.12 0.18.0-m6 -...

com.github.agourlay:cornichon-core_2.12 (0.15.0), com.github.agourlay:cornichon-experimental_2.12 (0.15.0) +33 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.0-m11)

co.fs2:fs2-io2.12 MAVEN version 0.10.0-m11 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.agourlay:cornichon-core2.12 0.15.0 - com.github.agourlay:cornichon-experimental2.12 0.15.0 -...

com.github.barambani:http4s-extend_2.12 (>=0.0.24, <=0.0.32), com.github.gvolpe:http4s-tracer_2.12 (0.1) +63 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.3)

co.fs2:fs2-io2.12 MAVEN version 0.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.barambani:http4s-extend2.12 =0.0.24, =0.5.0, =0.11.0, =0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.5, =0.1.6 -...

com.spinoco:fs2-http_2.11 (0.2.0-rc1), io.frees:frees-http-http4s_2.11 (0.4.0) +23 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m6)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m6 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.spinoco:fs2-http2.11 0.2.0-rc1 - io.frees:frees-http-http4s2.11 0.4.0 - io.frees:frees-http4s2.11 =0.4.1, =0.18.0-m1,...

com.qvantel:jsonapi-scala-http4s-client_2.11 (6.0.0), io.frees:frees-http4s_2.11 (>=0.4.5, <=0.5.0) +22 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m8)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m8 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.11 6.0.0 - io.frees:frees-http4s2.11 =0.4.5, =0.5.0 -...

com.qvantel:jsonapi-scala-http4s-client_2.11 (>=6.0.1, <=6.1.0), org.http4s:http4s-argonaut_2.11 (0.18.0-m6) +21 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m9)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m9 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.11 =6.0.1, =6.1.0 - org.http4s:http4s-argonaut2.11 0.18.0-m6 -...

com.github.barambani:http4s-extend_2.11 (>=0.0.24, <=0.0.32), com.github.gvolpe:http4s-tracer_2.11 (0.1) +51 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.3)

co.fs2:fs2-io2.11 MAVEN version 0.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 =0.0.24, =0.11.0, =0.3, =0.1.1, =0.1.1, =0.1.1, =0.1.5, =0.0.1-m10, =0.0.1-m10,...

com.github.barambani:http4s-extend_2.11 (0.0.43), com.github.pureconfig:pureconfig-http4s_2.11 (0.10.2) +31 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.6)

co.fs2:fs2-io2.11 MAVEN version 0.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 0.0.43 - com.github.pureconfig:pureconfig-http4s2.11 0.10.2 -...

com.github.allantl:atlassian-connect-http4s_2.12 (>=0.1.0, <=0.1.2), com.github.allantl:jira4s_2.12 (0.2.0) +291 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (7.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.allantl:atlassian-connect-http4s2.12 =0.1.0, =1.4, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-32643

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

org.apache.tomcat:tomcat-catalina-ha (8.0.37), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.37) +4 more potentially affected by CVE-2024-52316 via org.apache.tomcat:tomcat-catalina (8.0.37)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.37 - org.apache.tomcat:tomcat-catalina-jmx-remote...

GHSA-54W6-VXFH-FW7F Http4s improperly parses User-Agent and Server headers

Impact The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. v0.21.x scala val unsafe: OptionUser-Agent = req.headers.getUser-Agent...

Http4s improperly parses User-Agent and Server headers

Impact The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. v0.21.x scala val unsafe: OptionUser-Agent = req.headers.getUser-Agent...

com.sksamuel.scruffy:scruffy-accord_2.10 (>=1.14.0-m1, <=1.14.0), com.sksamuel.scruffy:scruffy-akka_2.10 (>=1.14.0-m1, <=1.14.0) +46 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.10 (>=0.1.0, <=0.9.3)

org.http4s:http4s-core2.10 MAVEN version =0.1.0, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0 and more Source cves: CVE-2023-22465 Source advisory:...

com.sksamuel.scruffy:scruffy-accord_2.10 (>=1.14.0-m1, <=1.14.0), com.sksamuel.scruffy:scruffy-akka_2.10 (>=1.14.0-m1, <=1.14.0) +46 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.10 (>=0.1.0, <=0.9.3)

org.http4s:http4s-core2.10 MAVEN version =0.1.0, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0 and more Source cves: CVE-2023-22465 Source advisory:...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +375 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.6.1, =0.6.1, =0.18.1, =0.18.7 - com.avast:datadog4s-http4s2.12 0.6.0 - com.avast:datadog4s2.12 0.6.0 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +375 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.6.1, =0.6.1, =0.18.1, =0.18.7 - com.avast:datadog4s-http4s2.12 0.6.0 - com.avast:datadog4s2.12 0.6.0 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...