https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:33:58 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1051 certfr-2025-avi-1051 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1051 https://cve.radiocsirt.org/vuln/euvd-2026-253330 EUVD-2026-253330 https://cve.radiocsirt.org/vuln/euvd-2026-253330 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59822 <p>Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.</p> <p>Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59822 https://cve.radiocsirt.org/vuln/ghsa-wcwh-7gfw-5wrr <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>### Summary http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to: - Bypass front-end servers security controls - Launch targeted attacks against active users - Poison web caches</p> <p>Pre-requisites for the exploitation: the web appication has to be deployed behind a reverse-proxy that forwards trailer headers.</p> <p>### Details The HTTP chunked message parser, after parsing the last body chunk, calls `parseTrailers` (`ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala#L122-142`). This method parses the trailer section using `Parser.parse`, where the issue originates.</p> <p>`parse` has a bug that allows to terminate the parsing before finding the double CRLF condition: when it finds an header line that **does not include the colon character**, it continues parsing with `state=false` looking for the header name till reaching the condition `else if (current == lf &amp;&amp; (idx &gt; 0 &amp;&amp; message(idx - 1) == cr))` that sets `complete=true` even if no `\r\n\r\n` is found. ```scala if (current == colon) { state = true // set state to check for header value name = new String(message, start, idx - start) // extract name string start = idx + 1 // advance past colon for next start</p> <p>// TODO: This if clause may not be necessary since the header value parser trims if (message.size &gt; idx + 1 &amp;&amp; message(idx + 1) == space) { start += 1 // if colon is followed by space advance again…</p> <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>### Summary http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to: - Bypass front-end servers security controls - Launch targeted attacks against active users - Poison web caches</p> <p>Pre-requisites for the exploitation: the web appication has to be deployed behind a reverse-proxy that forwards trailer headers.</p> <p>### Details The HTTP chunked message parser, after parsing the last body chunk, calls `parseTrailers` (`ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala#L122-142`). This method parses the trailer section using `Parser.parse`, where the issue originates.</p> <p>`parse` has a bug that allows to terminate the parsing before finding the double CRLF condition: when it finds an header line that **does not include the colon character**, it continues parsing with `state=false` looking for the header name till reaching the condition `else if (current == lf &amp;&amp; (idx &gt; 0 &amp;&amp; message(idx - 1) == cr))` that sets `complete=true` even if no `\r\n\r\n` is found. ```scala if (current == colon) { state = true // set state to check for header value name = new String(message, start, idx - start) // extract name string start = idx + 1 // advance past colon for next start</p> <p>// TODO: This if clause may not be necessary since the header value parser trims if (message.size &gt; idx + 1 &amp;&amp; message(idx + 1) == space) { start += 1 // if colon is followed by space advance again…</p> https://cve.radiocsirt.org/vuln/ghsa-wcwh-7gfw-5wrr