Description
Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.
Scores
CVSS v3
7.5
EPSS
0.0007
EPSS Percentile
20.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-444
Status
published
Products (5)
org.http4s/http4s-ember-core_2.12
0 - 0.23.31Maven
org.http4s/http4s-ember-core_2.13
0 - 0.23.31Maven
org.http4s/http4s-ember-core_3
0 - 0.23.31Maven
typelevel/http4s
1.0.0 milestone1 (44 CPE variants)
typelevel/http4s
< 0.23.31
Published
Sep 23, 2025
Tracked Since
Feb 18, 2026