Vulnerability record · CVE-2025-59822 · published 23 September 2025

CVE-2025-59822: Typelevel http4s http request smuggling vulnerability

Typelevel · Http4s

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

6.3 CVSS 4.0 Medium EPSS 0.37% · top 71.2% CWE-444 · HTTP request smuggling

6.3CVSS 4.0 base score

0.37%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Http4s Typelevel

References

Link	Tags
https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41	Patch
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr	ExploitVendor Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr	ExploitVendor Advisory

Track CVE-2025-59822 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2021-39185Typelevel http4s origin validation error vulnerabilityHttp4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.…EPSS 0.59%1 Sep 2021 7.5CVE-2021-21294Typelevel http4s uncontrolled resource consumption vulnerabilityHttp4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have…EPSS 2.1%2 Feb 2021 7.5CVE-2020-5280Typelevel http4s relative path traversal vulnerabilityhttp4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.s…EPSS 7.0%25 Mar 2020 5.8CVE-2021-32643Typelevel http4s path traversal vulnerabilityHttp4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `fi…EPSS 1.4%27 May 2021 5.3CVE-2023-22465Typelevel http4s improper input validation vulnerabilityHttp4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-…EPSS 0.85%4 Jan 2023 4.7CVE-2021-41084Typelevel http4s server-side request forgery (ssrf) vulnerabilityhttp4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when …EPSS 1.2%21 Sep 2021 6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 7.1%analysed26 May 2026 7.5CVE-2025-61884Oracle E-Business Suite Configurator pre-auth data exposure flawOracle Configurator in Oracle E-Business Suite 12.2.3 through 12.2.14 exposes a vulnerability reachable over HTTP without authentication. A successfu…KEVEPSS 96%analysed12 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2025-59822), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.