Skip to content
OpenAdvisories

Vendor

org.http4s

2 known vulnerabilities.

Products

blaze-http_2.13 1 blaze-http_3 1 http4s-blaze-server_2.13 1 http4s-ember-core_2.12 1 http4s-ember-core_2.13 1 http4s-ember-core_3 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-73494

    blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/par…

    http4s org.http4s blaze blaze-http_3 Maven
  • High 8.2
    CVE-2026-54556

    Http4s: HTTP/2 Denial of Service with Ember Backend

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http…

    http4s org.http4s http4s http4s-ember-core_2.13 Maven