EUVD-2026-79289
GHSA-fm4g-76c9-7w69
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in NonceKeeper causes fresh nonces to be discarded while eviction halts at the first stale entry, so the nonce map grows without bound. Any application that protects at least one route with DigestAuth and runs a version prior to 0.23.35 or 1.0.0-M47 is affected, and an unauthenticated remote attacker can drive repeated 401 authentication challenges until the JVM throws OutOfMemoryError and the service collapses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
We need answer JSON only. Need obey rules. Need synthesize. Let's inspect. CVE-2026-69204 http4s Ember request smugglin
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote atta
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensiti
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely expl
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a singl
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5),
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - incl
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today