Advisories · Technology
http4s.
Every CVE that names http4s among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
Http4s: Ember Server accepts duplicate Content-Length headers
- http4s
- HTTP request smuggling
- CVSS 7.5 High
Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
- http4s
- Denial of service
- CWE-1284
- CVSS 5.9 Medium
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
- http4s
- Information disclosure
- Weak cryptography or TLS
- CVSS 4.8 Medium
Http4s: Set-Cookie rendering does not escape attribute delimiters
- http4s
- Other injection
- CWE-1286
- CVSS 7.5 High
Http4s: WebSocket decoder accepts unbounded message sizes
- http4s
- Denial of service