EUVD-2023-0335

Malicious code in bioql PyPI...

dev.hnaderi:scala-k8s-http4s-ember_sjs1_2.12 (>=0.11.0 <=0.25.0), dev.hnaderi:scala-k8s-http4s_sjs1_2.12 (>=0.4.0 <=0.10.0) +6 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_sjs1_2.12 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-coresjs12.12 MAVEN version =0.23.10, =0.11.0, =0.4.0, =0.0.10, =0.0.10, =0.23.10, =0.23.10, =0.0.1, =0.0.9 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019567...

dev.hnaderi:scala-k8s-http4s-ember_native0.4_2.13 (>=0.11.0 <=0.25.0), dev.hnaderi:scala-k8s-http4s_native0.4_2.13 (>=0.4.0 <=0.10.0) +33 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.13 (>=0.23.16 <=0.23.30)

org.http4s:http4s-ember-corenative0.42.13 MAVEN version =0.23.16, =0.11.0, =0.4.0, =0.0.1, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =1.44.0+0.0.6 - io.chrisdavenport:http...

org.http4s:http4s-ember-client_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44), org.http4s:http4s-ember-server_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44) potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.13 (>=1.0.0-M37 <=1.0.0-M44)

org.http4s:http4s-ember-corenative0.42.13 MAVEN version =1.0.0-M37, =1.0.0-M37, =1.0.0-M37, =1.0.0-M44 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019562...

dev.hnaderi:scala-k8s-http4s-ember_native0.4_2.12 (>=0.11.0 <=0.25.0), dev.hnaderi:scala-k8s-http4s_native0.4_2.12 (>=0.4.0 <=0.10.0) +3 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_native0.4_2.12 (>=0.23.16 <=0.23.30)

org.http4s:http4s-ember-corenative0.42.12 MAVEN version =0.23.16, =0.11.0, =0.4.0, =0.23.16, =0.23.16, =0.0.1, =0.0.9 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019565...

io.jobial:scase-http4s_2.13 (>=2.1.0 <=2.2.2), io.jobial:scase_2.13 (>=2.1.0 <=2.2.2) +1 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_2.13 (>=1.0.0-M30 <=1.0.0-M37)

org.http4s:http4s-ember-server2.13 MAVEN version =1.0.0-M30, =2.1.0, =2.1.0, =2.2.2 - io.taig:taigless-storage-http4s-server2.13 =0.15.0 Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019553...

dev.i10416:slackapis-core_2.12 (>=0.0.1 <=0.0.2), es.weso:rdfshape-server_2.12 (=0.0.73) +16 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_2.12 (>=1.0.0-M2 <=1.0.0-M4)

org.http4s:http4s-ember-core2.12 MAVEN version =1.0.0-M2, =0.0.1, =0.1.90, =0.1.90, =0.1.90, =0.1.91, =0.1.109, =0.1.91, =0.1.101, =0.0.82, =0.0.14, =0.1.91, =2.1.0, =2.1.0, =2.2.2 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019566...

com.47deg:energy-monitor-persistence-app_sjs1_3 (=0.2.0), com.disneystreaming.smithy4s:smithy4s-tests_sjs1_3 (>=0.12.1 <=0.16.1) +25 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-server_sjs1_3 (>=0.23.10 <=0.23.30)

org.http4s:http4s-ember-serversjs13 MAVEN version =0.23.10, =0.12.1, =0.1.0, =0.1.0+0.0.1, =2.14.0+0.0.1, =0.9.0+0.0.1, =2.12.0+0.0.1, =0.15.0+0.0.1, =2.13.0+0.0.1, =2.34.0+0.0.1, =2.20.0+0.0.1, =1.11.0+0.0.1, =3.9.0+0.0.1, =3.21.4+0.0.6 - io.chrisdavenport:http4s-grpc-g...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0 <=0.7.0), com.47deg:embedded-cassandra-core_2.12 (=0.0.7) +465 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (>=2.0.0 <=2.5.12)

co.fs2:fs2-io2.12 MAVEN version =2.0.0, =0.3.0, =0.22.0, =0.0.1, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.7.0, =0.7.0, =0.18.1, =0.17.0, =0.17.0, =0.1.21, =0.19.3 and more Source cves: CVE-2025-58369 Source advisory: SNYK:JAVA-COFS2-12669991...

com.47deg:freestyle-http-http4s_2.11 (=0.1.0), com.azavea.geotrellis:geotrellis-server-core_2.11 (>=4.0.1 <=4.2.0) +173 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (>=0.9.1 <=2.1.0)

co.fs2:fs2-io2.11 MAVEN version =0.9.1, =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =5.0.0, =2.0.0, =0.12.7, =0.12.7, =0.12.7, =0.14.1, =0.12.7, =1.1.0, =1.2.1 and more Source cves: CVE-2025-58369 Source advisory: SNYK:JAVA-COFS2-13180115...

io.github.jmcardon:tsec-bouncy_2.13.0-M5 (>=0.1.0 <=0.1.0-M4), io.github.jmcardon:tsec-cipher-bouncy_2.13.0-M5 (>=0.1.0 <=0.1.0-M4) +41 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.13.0-M5 (>=1.0.3 <=1.0.4)

co.fs2:fs2-io2.13.0-M5 MAVEN version =1.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.20.0, =0.20.10 and more Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFFJ...

PT-2025-36337

Name of the Vulnerable Software and Affected Versions: fs2 versions 3.12.2 and lower fs2 versions 3.13.0-M1 through 3.13.0-M6 Description: fs2, a compositional, streaming I/O library for Scala, is susceptible to denial of service attacks through TLS sessions when using fs2-io on the JVM with the...

Linux Distros Unpatched Vulnerability : CVE-2017-15288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in...

Linux Distros Unpatched Vulnerability : CVE-2022-36944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java...

Malicious code in test-mlw2-mucro-scala (npm)

The package test-mlw2-mucro-scala was found to contain malicious code...

MAL-2025-35820 Malicious code in test-mlw2-mucro-scala (npm)

The package test-mlw2-mucro-scala was found to contain malicious code...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file

Summary Scala could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in LazyList. By sending specially-crafted request using gadget chain, an attacker could exploit this vulnerability to execute arbitrary code, erase contents of...

CVE-2023-22465

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

CVE-2020-7907

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections...

CVE-2014-125001

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended...