Denial-Of-Service (DoS)

Http4s is vulnerable to a denial-of-service DoS. The vulnerability is due to improper enforcement of HTTP/2 concurrent stream limits, which allows an unauthenticated attacker to create an unbounded number of streams and consume heap memory until exhaustion...

Denial-of-Service (DoS)

Http4s is vulnerable to a Denial-of-Service DoS. The vulnerability is due to HTTP/2 flow-control windows being replenished based on network-received bytes while DATA is stored in an unbounded channel, which allows an attacker to send HTTP/2 request bodies faster than the application consumes them...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

Directory Traversal

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker c...