Http4S
Monthly
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. No public exploit has been identified at time of analysis, but exploitation is trivially low-complexity: a single connection sending a stream of continuation frames that never assert FIN is sufficient.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. No public exploit has been identified at time of analysis, but exploitation is trivially low-complexity: a single connection sending a stream of continuation frames that never assert FIN is sufficient.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.