co.topl:bifrost-daml-broker_2.13 (=1.0.0.beta-2), co.topl:brambl-cli_2.13 (>=2.0.0-beta1 <=2.0.0-beta6) +120 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.13 (>=0.10.0-M10 <=0.23.30)

org.http4s:http4s-ember-core2.13 MAVEN version =0.10.0-M10, =2.0.0-beta1, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.12.1, =7.1.0, =0.1.0, =0.21.0, =0.20.4, =0.22.1 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019559...

io.taig:taigless-storage-http4s-server_2.13 (=0.15.0), org.http4s:http4s-ember-client_2.13 (>=1.0.0-M4 <=1.0.0-M44) +1 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.13 (>=1.0.0-M37 <=1.0.0-M44)

org.http4s:http4s-ember-core2.13 MAVEN version =1.0.0-M37, =1.0.0-M4, =1.0.0-M4, =1.0.0-M44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019559...

dev.i10416:slackapis-core_3 (>=0.0.1 <=0.0.2), es.weso:schema_3 (>=0.1.103 <=0.2.4) +21 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_3 (>=1.0.0-M22 <=1.0.0-M44)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-M22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =0.1.0, =0.1.7 and more Source cves: CVE-2025-59822 Source advisory: OSV:GHSA-WCWH-7GFW-5WRR...

co.topl:brambl-cli_2.13 (>=2.0.0-beta1 <=2.0.0-beta6), com.47deg:energy-monitor-persistence-app_2.13 (=0.2.0) +70 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_2.13 (>=0.22.10 <=0.23.30)

org.http4s:http4s-ember-server2.13 MAVEN version =0.22.10, =2.0.0-beta1, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.12.1, =7.1.0, =0.1.0, =0.20.4, =0.0.1, =1.0.0, =1.0.0, =5.0.0 - com.snowplowanalytics:loaders-common2.13 =0.1.0-M5 and more Source cves: CVE-2025-59822 Source advisor...

io.jobial:scase-http4s_2.13 (>=2.1.0 <=2.2.2), io.jobial:scase_2.13 (>=2.1.0 <=2.2.2) +1 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_2.13 (>=1.0.0-M30 <=1.0.0-M37)

org.http4s:http4s-ember-server2.13 MAVEN version =1.0.0-M30, =2.1.0, =2.1.0, =2.2.2 - io.taig:taigless-storage-http4s-server2.13 =0.15.0 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019553...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

org.creativescala:krop-core_sjs1_3 (>=0.6.0 <=0.9.4) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_sjs1_3 (>=1.0.0-M40 <=1.0.0-M44)

org.http4s:http4s-ember-serversjs13 MAVEN version =1.0.0-M40, =0.6.0, =0.9.4 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019554...

dev.i10416:slackapis-core_sjs1_3 (>=0.0.1 <=0.0.2), org.creativescala:krop-core_sjs1_3 (>=0.6.0 <=0.9.4) +2 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_3 (>=1.0.0-M24 <=1.0.0-M44)

org.http4s:http4s-ember-coresjs13 MAVEN version =1.0.0-M24, =0.0.1, =0.6.0, =1.0.0-M24, =1.0.0-M24, =1.0.0-M44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019563...

com.47deg:energy-monitor-persistence-app_sjs1_2.13 (=0.2.0), com.disneystreaming.smithy4s:smithy4s-tests_sjs1_2.13 (>=0.12.1 <=0.16.1) +43 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_2.13 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-coresjs12.13 MAVEN version =0.23.10, =0.12.1, =0.11.0, =0.4.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =3.6.0+0.0.6 - io.chrisdavenport:http4s-grp...

com.47deg:energy-monitor-persistence-app_sjs1_3 (=0.2.0), com.disneystreaming.smithy4s:smithy4s-tests_sjs1_3 (>=0.12.1 <=0.16.1) +44 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_3 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-coresjs13 MAVEN version =0.23.10, =0.12.1, =0.1.0, =0.11.0, =0.4.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =3.6.0+0.0.6 and more Source cves: CVE...

org.http4s:http4s-ember-client_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44), org.http4s:http4s-ember-server_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44)

org.http4s:http4s-ember-corenative0.42.13 MAVEN version =1.0.0-M37, =1.0.0-M37, =1.0.0-M37, =1.0.0-M44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019562...

com.47deg:energy-monitor-persistence-app_sjs1_2.13 (=0.2.0), com.disneystreaming.smithy4s:smithy4s-tests_sjs1_2.13 (>=0.12.1 <=0.16.1) +25 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_sjs1_2.13 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-serversjs12.13 MAVEN version =0.23.10, =0.12.1, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =3.9.0+0.0.1, =3.21.4+0.0.6 - io.chrisdavenport:http4s-grpc-google-cloud...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

ai.starlake:quack-on-demand_3 (>=0.1.0 <=0.3.1), com.47deg:energy-monitor-persistence-app_3 (=0.2.0) +164 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_3 (>=0.22.0-M8 <=0.23.30)

org.http4s:http4s-ember-core3 MAVEN version =0.22.0-M8, =0.1.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =1.0.0, =0.12.1, =7.1.0, =0.22.0, =0.22.1 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019560...

dev.i10416:slackapis-core_3 (>=0.0.1 <=0.0.2), es.weso:schema_3 (>=0.1.103 <=0.2.4) +21 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_3 (>=1.0.0-M22 <=1.0.0-M44)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-M22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =0.1.0, =0.1.7 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019560...

dev.hnaderi:scala-k8s-http4s-ember_sjs1_2.12 (>=0.11.0 <=0.25.0), dev.hnaderi:scala-k8s-http4s_sjs1_2.12 (>=0.4.0 <=0.10.0) +6 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_2.12 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-coresjs12.12 MAVEN version =0.23.10, =0.11.0, =0.4.0, =0.0.10, =0.0.10, =0.23.10, =0.23.10, =0.0.1, =0.0.9 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019567...

com.kubukoz:spotify-next_native0.4_3 (>=1.9.3 <=1.11.3), io.chrisdavenport:http4s-grpc-google-cloud-alloydb-v1_native0.4_3 (>=0.1.0+0.0.1 <=0.22.0+0.0.6) +22 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_native0.4_3 (>=0.23.16 <=0.23.30)

org.http4s:http4s-ember-servernative0.43 MAVEN version =0.23.16, =1.9.3, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =3.9.0+0.0.1, =0.106.0+0.0.1, =0.127.0+0.0.6 -...

com.armanbilge:sbt-bundlemon_2.12_1.0 (=0.1.4), com.avast:sst-bundle-monix-http4s-ember_2.12 (>=0.17.0 <=0.19.3) +67 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-M10 <=0.23.30)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-M10, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.12.1, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019566...

io.chrisdavenport:http4s-grpc-google-cloud-alloydb-v1_native0.4_2.13 (>=0.1.0+0.0.1 <=0.22.0+0.0.6), io.chrisdavenport:http4s-grpc-google-cloud-bigqueryconnection-v1_native0.4_2.13 (>=2.14.0+0.0.1 <=2.47.0+0.0.6) +21 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_native0.4_2.13 (>=0.23.18 <=0.23.30)

org.http4s:http4s-ember-servernative0.42.13 MAVEN version =0.23.18, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =3.9.0+0.0.1, =0.106.0+0.0.1, =0.127.0+0.0.6 - io.chrisdavenport:htt...

dev.hnaderi:scala-k8s-http4s-ember_native0.4_2.13 (>=0.11.0 <=0.25.0), dev.hnaderi:scala-k8s-http4s_native0.4_2.13 (>=0.4.0 <=0.10.0) +33 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.13 (>=0.23.16 <=0.23.30)

org.http4s:http4s-ember-corenative0.42.13 MAVEN version =0.23.16, =0.11.0, =0.4.0, =0.0.1, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =1.44.0+0.0.6 - io.chrisdavenport:http...