CVE-2025-59822
Description
Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.
How to fix
- typelevel http4s0.23.31 or later
- org.http4s:http4s-ember-core_2.120.23.31 or later
- org.http4s:http4s-ember-core_2.130.23.31, 1.0.0-M45 or later
- org.http4s:http4s-ember-core_30.23.31, 1.0.0-M45 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typelevel http4s | v < 0.23.31, 1.0.0 | 0.23.31 |
| org.http4s:http4s-ember-core_2.12Maven | v < 0.23.31 | 0.23.31 |
| org.http4s:http4s-ember-core_2.13Maven | v < 0.23.31, 1.0.0-M1 ≤ v < 1.0.0-M45 | 0.23.31, 1.0.0-M45 |
| org.http4s:http4s-ember-core_3Maven | v < 0.23.31, 1.0.0-M1 ≤ v < 1.0.0-M45 | 0.23.31, 1.0.0-M45 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.