io.chrisdavenport:shellserve_sjs1_2.12 (0.0.2) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_sjs1_2.12 (0.23.12)

org.http4s:http4s-ember-serversjs12.12 MAVEN version 0.23.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-ember-serversjs12.12 and may be impacted: - io.chrisdavenport:shellservesjs12.12 0.0.2 Source cves: CVE-2025-59822 Source...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

dev.hnaderi:scala-k8s-http4s-ember_native0.4_2.12 (>=0.11.0, <=0.25.0), dev.hnaderi:scala-k8s-http4s_native0.4_2.12 (>=0.4.0, <=0.10.0) +3 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.12 (>=0.23.16, <=0.23.30)

org.http4s:http4s-ember-corenative0.42.12 MAVEN version =0.23.16, =0.11.0, =0.4.0, =0.23.16, =0.23.16, =0.0.1, =0.0.9 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019565...

com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +69 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.30)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2025-59822 Source advisory: GHSA-WCWH-7GFW-5WRR...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper parsing of the HTTP trailer section in the parse function. An attacker can bypass security controls, launch targeted attacks against users, or poison web caches by crafting specially formed HTTP...

org.http4s:http4s-ember-client_native0.4_3 (>=1.0.0-m37, <=1.0.0-m44), org.http4s:http4s-ember-server_native0.4_3 (>=1.0.0-m37, <=1.0.0-m44) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_3 (>=1.0.0-m37, <=1.0.0-m44)

org.http4s:http4s-ember-corenative0.43 MAVEN version =1.0.0-m37, =1.0.0-m37, =1.0.0-m37, =1.0.0-m44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019564...

co.topl:bifrost-daml-broker_2.13 (1.0.0.beta-2), co.topl:brambl-cli_2.13 (>=2.0.0-beta1, <=2.0.0-beta6) +124 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.13 (>=0.10.0-m10, <=0.23.30)

org.http4s:http4s-ember-core2.13 MAVEN version =0.10.0-m10, =2.0.0-beta1, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.1.0, =0.21.0, =0.22.1 and more Source cves: CVE-2025-59822 Source advisory: OSV:GHSA-WCWH-7GFW-5WRR...

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Summary http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to: - Bypass front-end servers security controls - Launch targeted attacks against active users - Poison web caches Pre-requisites for the exploitatio...

dev.i10416:slackapis-core_sjs1_2.13 (>=0.0.1, <=0.0.2), org.http4s:http4s-ember-client_sjs1_2.13 (>=1.0.0-m24, <=1.0.0-m44) +1 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_2.13 (>=1.0.0-m24, <=1.0.0-m44)

org.http4s:http4s-ember-coresjs12.13 MAVEN version =1.0.0-m24, =0.0.1, =1.0.0-m24, =1.0.0-m24, =1.0.0-m44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019561...

ai.starlake:quack-on-demand_3 (>=0.1.0, <=0.4.0), com.47deg:energy-monitor-persistence-app_3 (0.2.0) +178 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_3 (>=0.22.0-m8, <=0.23.30)

org.http4s:http4s-ember-core3 MAVEN version =0.22.0-m8, =0.1.0, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =1.0.0, =0.0.0-3-cca5341b, =7.1.0, =7.1.1 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019560...

io.taig:taigless-storage-http4s-server_2.13 (0.15.0), org.http4s:http4s-ember-client_2.13 (>=1.0.0-m37, <=1.0.0-m44) +1 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.13 (>=1.0.0-m37, <=1.0.0-m44)

org.http4s:http4s-ember-core2.13 MAVEN version =1.0.0-m37, =1.0.0-m37, =1.0.0-m37, =1.0.0-m44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019559...

org.creativescala:krop-core_sjs1_3 (>=0.6.0, <=0.9.4) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_sjs1_3 (>=1.0.0-m40, <=1.0.0-m44)

org.http4s:http4s-ember-serversjs13 MAVEN version =1.0.0-m40, =0.6.0, =0.9.4 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019554...

dev.i10416:slackapis-core_sjs1_3 (>=0.0.1, <=0.0.2), org.creativescala:krop-core_sjs1_3 (>=0.6.0, <=0.9.4) +2 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_3 (>=1.0.0-m24, <=1.0.0-m44)

org.http4s:http4s-ember-coresjs13 MAVEN version =1.0.0-m24, =0.0.1, =0.6.0, =1.0.0-m24, =1.0.0-m24, =1.0.0-m44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019563...

Http4s security vulnerabilities

Http4s is an open source streaming HTTP server for Scala from Http4s Open Source. A security vulnerability exists in Http4s versions 1.0.0-M1 through 1.0.0-M45 and prior to 0.23.31, which stems from mishandling of the HTTP trailer section and could lead to an HTTP request entrapment technique...

CVE-2025-59822: Inconsistent Interpretation of HTTP Requests

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls...

PT-2025-39209

Name of the Vulnerable Software and Affected Versions Http4s versions 1.0.0-M1 through 1.0.0-M44 Http4s versions prior to 0.23.31 Description Http4s is susceptible to HTTP Request Smuggling because of incorrect handling of the HTTP trailer section. This can allow attackers to circumvent front-end...