http4s vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20215
3. 20231
4. 20251
5. 202623

Newest CVEs

• CVE-2026-61741

  http4s-scala-xml has an XML External Entity (XXE) processing issue

  http4s · http4s-scala-xml

  Critical9.3
• CVE-2026-88975

  Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

  http4s · http4s

  High7.5
• CVE-2026-69206

  Http4s: DigestAuth allows replay of captured requests

  http4s · http4s

  Medium5.9
• CVE-2026-69202

  Http4s Ember HTTP/2: unbounded inbound body buffering

  http4s · http4s

  High7.5
• CVE-2026-69218

  Http4s Ember HTTP/2: unbounded continuation frame accumulation

  http4s · http4s

  High7.5
• CVE-2026-69203

  Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

  http4s · http4s

  High7.5
• CVE-2026-69217

  Http4s: Ember Server accepts duplicate Content-Length headers

  http4s · http4s

  High8.7
• CVE-2026-69210

  Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

  http4s · http4s

  High7.5
• CVE-2026-69215

  Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

  http4s · http4s

  Medium6.8
• CVE-2026-69205

  Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

  http4s · http4s

  High8.7