Typelevel http4s 1.0.0 Milestone 33
Approved changes feed: RSS · Atom
cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*
part: a version: 1.0.0 update: milestone33
| Vendor | Typelevel (ae0d1341-5b6f-53da-b68c-914a850a6910) |
|---|---|
| Product | Http4S (a2122f7e-d89a-58a8-8588-8921f089cb5b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/http4s/http4s |
purl2cpe | 2026-06-01 10:11:18.456195 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-59822 |
vulnerable | 2026-06-08 07:35:23.249182 |
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.
Published: 2025-09-23T18:54:42.867Z
Updated: 2025-09-23T19:17:26.320Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22465 |
vulnerable | 2026-06-08 05:54:26.373987 |
Http4s has fatal error parsing User-Agent and Server headers
HIGH (7.5)
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
Published: 2023-01-04T15:30:04.129Z
Updated: 2025-03-10T21:32:44.734Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.