CVE-2025-59822
Full vulnerability record from the local CVENow database.
Description
Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-09-23 19:15:42.303000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-59822",
"sourceIdentifier": "[email protected]",
"published": "2025-09-23T19:15:42.303",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31."
},
{
"lang": "es",
"value": "Http4s es una interfaz Scala para servicios HTTP. En versiones desde la 1.0.0-M1 hasta antes de la 1.0.0-M45 y antes de la 0.23.31, http4s es vulnerable a HTTP Request Smuggling debido a un manejo inadecuado de la sección de tráiler HTTP. Esta vulnerabilidad podría permitir a los atacantes eludir los controles de seguridad de los servidores front-end, lanzar ataques dirigidos contra usuarios activos y envenenar las cachés web. Un prerrequisito para la explotación implica que la aplicación web esté desplegada detrás de un proxy inverso que reenvía los encabezados de tráiler. Este problema ha sido parcheado en las versiones 1.0.0-M45 y 0.23.31."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "http4s",
"product": "http4s",
"versions": [
{
"version": "< 0.23.31",
"status": "affected"
},
{
"version": ">= 1.0.0-M1, < 1.0.0-M45",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T19:15:00.938453Z",
"id": "CVE-2025-59822",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-444"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.23.31",
"matchCriteriaId": "861A0064-65E6-4742-8A82-2942BCCAA03B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
"matchCriteriaId": "65C497F9-281C-4565-BD36-B6B4D7E6F8BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
"matchCriteriaId": "6FCFC3E5-7530-4AAA-A2C7-36DC307B613B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
"matchCriteriaId": "D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
"matchCriteriaId": "76F8BC53-544C-4285-8D9B-CB91AD080048"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
"matchCriteriaId": "778947CA-20BA-469F-87E1-97D8713ACC75"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
"matchCriteriaId": "F5B02828-1E40-49BE-8367-10296625C696"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
"matchCriteriaId": "A569F32F-3C8C-4F8F-B0BC-6ADC993596A9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
"matchCriteriaId": "525DBF4B-F574-459D-9CE2-6AF597ABAE10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
"matchCriteriaId": "FD05B15E-1E4F-43EA-B21A-3B96A77814D6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
"matchCriteriaId": "65C79F52-F05F-4F0A-AC27-393197B9EF00"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
"matchCriteriaId": "A426B4C0-643A-492F-B7FB-725549F613F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
"matchCriteriaId": "D95E231C-3D13-45FC-AF9A-CB8CF1FFC983"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
"matchCriteriaId": "CF973F58-0AC7-4B58-A2CF-654133CE7F1A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
"matchCriteriaId": "35C40331-C96C-477C-B6BD-D5506E612DA8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
"matchCriteriaId": "615BC827-3E0F-4C1E-8FD2-B59FF31F2D49"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
"matchCriteriaId": "FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
"matchCriteriaId": "97F74D04-031E-47D4-BA57-DBE9C74CE256"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*",
"matchCriteriaId": "2FDC2E12-DE86-4A82-BD2F-C18F715CA673"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*",
"matchCriteriaId": "C1C18467-5FD0-4DCC-8B75-979C03BFF1C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*",
"matchCriteriaId": "6724B3CF-A393-469B-BA80-CED8AB98358A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*",
"matchCriteriaId": "804EF10D-46A9-49C0-B1C4-74B832115662"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*",
"matchCriteriaId": "2DE365D6-17C4-4E82-8F2B-1DA18CC8382F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
"matchCriteriaId": "DE093D65-1B3A-4A4A-BC76-05DEF9529712"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*",
"matchCriteriaId": "078E27D3-AD80-44E8-A97C-328AEB4E2929"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*",
"matchCriteriaId": "548DB4B7-872D-4A7E-9DA7-D0BF15BDE969"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*",
"matchCriteriaId": "07037A73-F463-4F8B-8F8B-AF513B31DA21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*",
"matchCriteriaId": "801D2731-BD6D-4CD9-B69F-75DC1A0FE3CD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*",
"matchCriteriaId": "AA2C32F3-93A3-4A2F-9A9A-DC06056EDC81"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*",
"matchCriteriaId": "59C3ECBA-47D1-4A9B-8193-8033BC27CC37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*",
"matchCriteriaId": "9B7AF9D4-4548-4D25-84BC-54C525179342"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*",
"matchCriteriaId": "0D884D1D-F74D-406F-A363-C008097C997E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:*",
"matchCriteriaId": "25F8BDE8-DBA8-484A-B3D5-01F1883E8BE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:*",
"matchCriteriaId": "BF4C693D-8E32-4DAC-9CB9-515949E196BE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
"matchCriteriaId": "DC3CA618-148D-4F97-9913-316DDDD97838"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:*",
"matchCriteriaId": "0F0BBAE2-5280-4F1E-880D-15865D9D056E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:*",
"matchCriteriaId": "42658BAE-1610-42B3-BC9A-E0C1AB0A1DEC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:*",
"matchCriteriaId": "E1361DEE-C784-44B8-88E8-9FD34AA4EA3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:*",
"matchCriteriaId": "1573CA36-84F2-4053-AB10-A9EA3E96F806"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:*",
"matchCriteriaId": "A8266609-3342-4E37-8518-1B83F41AFE52"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
"matchCriteriaId": "02FA538C-9D8A-49D5-8268-1A2C3E96B89B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
"matchCriteriaId": "D18A3ABC-5C47-45BF-978C-5BB17787DCFA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
"matchCriteriaId": "1CE1CF51-E61A-418A-AB22-9D7A6D690BAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
"matchCriteriaId": "29A70AAA-B77A-4291-A700-C910362DB8D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
"matchCriteriaId": "9F8F3C38-57AB-4CBC-8959-7FF51CBA7907"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
]
}
]
}