How many CVEs does typelevel http4s have?

typelevel http4s has 7 published CVE records since 2020.

How many typelevel http4s CVEs are in CISA KEV?

None of typelevel http4s's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for typelevel http4s vulnerabilities?

Yes — 2 of typelevel http4s's CVEs have a known public exploit.

Which versions of typelevel http4s are affected?

30 distinct typelevel http4s versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in typelevel http4s CVEs?

typelevel http4s's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal), CWE-346 (Origin Validation Error).

How many critical typelevel http4s vulnerabilities are there?

typelevel http4s has 1 critical and 4 high-severity CVEs.

What is the average severity of typelevel http4s CVEs?

The average CVSS base score across typelevel http4s's scored CVEs is 7.5.

typelevel http4s Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every typelevel http4s version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

1.0.0 <= v <= 1.0.05 CVEs
0.23.0 <= v <= 0.23.02 CVEs
< 0.18.261 CVE
< 0.21.171 CVE
< 0.21.291 CVE
< 0.23.311 CVE
<= 0.21.261 CVE
0.1.0 <= v < 0.21.341 CVE
0.19.0 <= v < 0.20.201 CVE
0.21.0 <= v < 0.21.21 CVE
0.21.7 <= v < 0.21.241 CVE
0.22.0 <= v < 0.22.151 CVE
0.22.0 <= v < 0.22.51 CVE
0.22.0 <= v <= 0.22.01 CVE
0.22.0 <= v <= 0.22.21 CVE
0.23.0 <= v < 0.23.171 CVE
0.23.0 <= v < 0.23.41 CVE
0.23.1 <= v <= 0.23.11 CVE

Fixed in

0.18.261 CVE
0.20.201 CVE
0.21.171 CVE
0.21.21 CVE
0.21.241 CVE
0.21.291 CVE
0.21.341 CVE
0.22.151 CVE
0.22.51 CVE
0.23.171 CVE
0.23.311 CVE
0.23.41 CVE

Find a version

7 CVEs

Sort

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
CVE-2025-59822
Public exploit
Patch
CWE-444
Medium · CVSS 6.3
EPSS 0.3% (27th pct)2025-09-23
High vulnerability · 2023-01-04
CVE-2023-22465
Public exploit
Patch
CWE-20
High · CVSS 7.5
EPSS 0.8% (54th pct)2023-01-04
Response Splitting from unsanitized headers in http4s
CVE-2021-41084
Patch
CWE-918
High · CVSS 8.7
EPSS 1.2% (66th pct)2021-09-21
Critical vulnerability · 2021-09-01
CVE-2021-39185
Patch
CWE-346
Critical · CVSS 9.1
EPSS 0.6% (45th pct)2021-09-01
Medium vulnerability · 2021-05-27
CVE-2021-32643
Patch
CWE-22
Medium · CVSS 5.8
EPSS 1.4% (70th pct)2021-05-27
Unbounded connection acceptance in http4s-blaze-server
CVE-2021-21294
Patch
CWE-400
High · CVSS 7.5
EPSS 2.1% (80th pct)2021-02-02
High vulnerability · 2020-03-25
CVE-2020-5280
Patch
CWE-23
High · CVSS 7.6
EPSS 6.8% (93th pct)2020-03-25

typelevel http4s Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other typelevel products

Frequently asked questions

References

Track typelevel http4s vulnerabilities