PT-2025-39209 · Http4S · Http4S

Sebastianosrt · Published 2025-09-23 · Updated 2025-10-08 · CVE-2025-59822

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Http4s versions 1.0.0-M1 through 1.0.0-M44 Http4s versions prior to 0.23.31

Description Http4s is susceptible to HTTP Request Smuggling because of incorrect handling of the HTTP trailer section. This can allow attackers to circumvent front-end server security measures, conduct attacks on current users, and corrupt web caches. Exploitation requires the web application to be deployed behind a reverse proxy that forwards trailer headers.

Recommendations Update to Http4s version 1.0.0-M45 or later. Update to Http4s version 0.23.31 or later.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-59822

GHSA-WCWH-7GFW-5WRR

Affected Products

Http4S

References · 12

• 🔥 https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59822.json · Exploit
• https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41 · Patch
• https://osv.dev/vulnerability/CVE-2025-59822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59822 · Security Note
• https://osv.dev/vulnerability/GHSA-wcwh-7gfw-5wrr · Vendor Advisory
• https://github.com/http4s/http4s · Note
• https://twitter.com/VulmonFeeds/status/1970672420613714257 · Twitter Post
• https://t.me/CVEtracker/33196 · Telegram Post
• https://twitter.com/CVEnew/status/1970621785407476040 · Twitter Post
• https://t.me/cveNotify/137862 · Telegram Post
• https://twitter.com/NightfallCVE/status/1970570878736859227 · Twitter Post