EUVD-2026-79191
GHSA-grh8-3p95-f9rr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 maven packages depend on org.http4s:http4s-client_2.12 (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 0.23.35.
DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies — to attacker-controlled hosts because versions prior to 0.23.35 and 1.0.0-M47 decide cookie applicability with unanchored substring checks instead of RFC 6265 domain and path matching. A cookie scoped to example.com is therefore also attached to requests for evilexample.com, api.example.com.attacker.net, or an unrelated path, so any attacker who can influence the outbound URL the application requests receives the cookie and can hijack that outbound session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages c
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote atta
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensiti
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely expl
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a singl
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in Nonc
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5),
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today