http4s

3 results · Clear filters · Feed

• Critical 9.3
  CVE-2026-61741

  http4s-scala-xml has an XML External Entity (XXE) processing issue

  http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any s…

  http4s http4s-scala-xml org.http4s:http4s-scala-xml_2.12 org.http4s:http4s-scala-xml_3 Maven
  Sep 24, 2026
• Critical 9.2
  CVE-2026-69204

  Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

  Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-serve…

  http4s http4s org.http4s:http4s-ember-core_2.13 org.http4s:http4s-ember-core_2.12 Maven
  Sep 15, 2026
• Critical 9.1
  CVE-2021-39185

  Default CORS config allows any origin with credentials

  Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The mid…

  http4s http4s org.http4s:http4s-server_2.12 org.http4s:http4s-server_3 Maven
  Sep 1, 2021