io.jobial:scase-http4s_2.13 (>=2.1.0, <=2.2.2), io.jobial:scase_2.13 (>=2.1.0, <=2.2.2) +1 more potentially affected by CVE-2026-69209 via org.http4s:http4s-ember-server_2.13 (>=1.0.0-m30, <=1.0.0-m37)

org.http4s:http4s-ember-server2.13 MAVEN version =1.0.0-m30, =2.1.0, =2.1.0, =2.2.2 - io.taig:taigless-storage-http4s-server2.13 0.15.0 Source cves: CVE-2026-69209 Source advisory: SNYK:JAVA-ORGHTTP4S-19851898...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

de.killaitis:http4s-cloud-functions_3 (>=0.4.1, <=0.4.2), io.getkyo:kyo-bench_3 (>=1.0.0-rc2, <=1.0.0-rc5) +22 more potentially affected by CVE-2026-69205 via org.http4s:http4s-server_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-server3 MAVEN version =1.0.0-m22, =0.4.1, =1.0.0-rc2, =0.1.0, =0.1-a2fae94, =0.1-5acc59b, =2.7.1, =0.10.8, =0.12.2, =0.10.0, =0.1, =0.1, =0.9.0, =0.10.1 and more Source cves: CVE-2026-69205 Source advisory: SNYK:JAVA-ORGHTTP4S-19869269...

Directory Traversal

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker c...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

Replay Attack

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +256 more potentially affected by CVE-2026-69206 via org.http4s:http4s-server_2.12 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-server2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.3.0, =0.18.1, =0.17.0, =0.17.0, =0.1.4, =0.17.0, =0.1.4, =0.17.0, =0.1.4, =0.1.4, =0.17.0, =0.17.0, =0.19.3 and more Source cves: CVE-2026-69206 Source advisory: SNYK:JAVA-ORGHTTP4S-19859837...

de.killaitis:http4s-cloud-functions_3 (>=0.4.1, <=0.4.2), io.getkyo:kyo-bench_3 (>=1.0.0-rc2, <=1.0.0-rc5) +22 more potentially affected by CVE-2026-69206 via org.http4s:http4s-server_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-server3 MAVEN version =1.0.0-m22, =0.4.1, =1.0.0-rc2, =0.1.0, =0.1-a2fae94, =0.1-5acc59b, =2.7.1, =0.10.8, =0.12.2, =0.10.0, =0.1, =0.1, =0.9.0, =0.10.1 and more Source cves: CVE-2026-69206 Source advisory: SNYK:JAVA-ORGHTTP4S-19859839...

de.killaitis:http4s-cloud-functions_3 (>=0.4.1, <=0.4.2), io.getkyo:kyo-bench_3 (>=1.0.0-rc2, <=1.0.0-rc5) +22 more potentially affected by CVE-2026-69201 via org.http4s:http4s-server_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-server3 MAVEN version =1.0.0-m22, =0.4.1, =1.0.0-rc2, =0.1.0, =0.1-a2fae94, =0.1-5acc59b, =2.7.1, =0.10.8, =0.12.2, =0.10.0, =0.1, =0.1, =0.9.0, =0.10.1 and more Source cves: CVE-2026-69201 Source advisory: GHSA-CRQ5-92J2-J7WV...

Missing Release of Memory after Effective Lifetime

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly triggering unauthenticated challenges, leading to unbounded growth of the nonce...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly triggering unauthenticated challenges, leading to unbounded growth of the nonce...

de.killaitis:http4s-cloud-functions_3 (>=0.4.1, <=0.4.2), io.getkyo:kyo-bench_3 (>=1.0.0-rc2, <=1.0.0-rc5) +22 more potentially affected by CVE-2026-69208 via org.http4s:http4s-server_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-server3 MAVEN version =1.0.0-m22, =0.4.1, =1.0.0-rc2, =0.1.0, =0.1-a2fae94, =0.1-5acc59b, =2.7.1, =0.10.8, =0.12.2, =0.10.0, =0.1, =0.1, =0.9.0, =0.10.1 and more Source cves: CVE-2026-69208 Source advisory: SNYK:JAVA-ORGHTTP4S-19851885...

com.codacy:kamon-http4s-1.0_2.13 (>=0.0.1, <=0.1.2), com.indoorvivants:hotswappage-http4s_2.13 (0.0.1) +41 more potentially affected by CVE-2026-69208 via org.http4s:http4s-server_2.13 (>=1.0.0-m2, <=1.0.0-m46)

org.http4s:http4s-server2.13 MAVEN version =1.0.0-m2, =0.0.1, =1.3.0, =0.4.1, =0.3.0, =1.0.0-rc1, =0.0.73, =0.1-a2fae94, =0.1-6257648 and more Source cves: CVE-2026-69208 Source advisory: SNYK:JAVA-ORGHTTP4S-19851886...

com.avast.grpc:grpc-json-bridge-http4s_2.12 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.12.0, <=0.12.2) +26 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server2.12 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =0.18.1, =0.18.1, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.gaborpihaj:http4s-jwt-auth-middleware_2.11 (0.1.0), com.github.agourlay:cornichon-http-mock_2.11 (>=0.12.7, <=0.16.1) +65 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.11 (>=0.2.0, <=0.21.0-m1)

org.http4s:http4s-server2.11 MAVEN version =0.2.0, =0.12.7, =0.0.3, =0.0.3-pre, =0.0.1-pre, =1.1.0, =0.1, =0.1.0-rc2, =1.0.4, =1.0.12 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.6.0), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +135 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.13 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-server2.13 MAVEN version =0.10.0-m10, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m1, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.avast.grpc:grpc-json-bridge-http4s_2.12 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.12.0, <=0.12.1) +25 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.12 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server2.12 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.18.1, =0.18.1, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-39185 Source advisory: GHSA-52CF-226F-RHR6...

org.http4s:http4s-blaze-server_2.11 (0.16.0a-rc3), org.http4s:http4s-jetty_2.11 (0.16.0a-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0a-rc3)

org.http4s:http4s-server2.11 MAVEN version 0.16.0a-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0a-rc3 - org.http4s:http4s-jetty2.11 0.16.0a-rc3 -...

org.http4s:http4s-blaze-server_2.11 (0.16.0a), org.http4s:http4s-jetty_2.11 (0.16.0a) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0a)

org.http4s:http4s-server2.11 MAVEN version 0.16.0a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0a - org.http4s:http4s-jetty2.11 0.16.0a -...