HTTP Request Smuggling Vulnerability in Http4s by Http4s
CVE-2025-59822
6.3MEDIUM
What is CVE-2025-59822?
Http4s, a popular Scala interface for HTTP services, is susceptible to HTTP Request Smuggling due to improper processing of the HTTP trailer section. This flaw allows attackers to circumvent front-end server security measures, execute targeted assaults on active users, and infect web caches. Exploitation requires that the web application be positioned behind a reverse-proxy capable of relaying trailer headers. The vulnerability has been rectified in versions 1.0.0-M45 and 0.23.31.
Affected Version(s)
http4s < 0.23.31 < 0.23.31
http4s >= 1.0.0-M1, < 1.0.0-M45 < 1.0.0-M1, 1.0.0-M45