CVE-2025-59822

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-59822

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59822.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-59822

Aliases

GHSA-wcwh-7gfw-5wrr

Published

2025-09-23T18:54:42.867Z

Modified

2026-07-15T01:49:10.560473262Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Details

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59822.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-444"
    ]
}

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

Fixed

36b243fc49ea692e4bf26241c75db53ff7d82261

Introduced

756ce63aee681c5b632bbeafe0b8fde2f3d237f4

Fixed

dd518f7c967e5165813b8d4a48a82b8fab852d41

Database specific

{
    "cpe": [
        "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.23.31"
        },
        {
            "introduced": "1.0.0-milestone1"
        },
        {
            "last_affected": "1.0.0-milestone1"
        },
        {
            "introduced": "1.0.0-milestone10"
        },
        {
            "last_affected": "1.0.0-milestone10"
        },
        {
            "introduced": "1.0.0-milestone11"
        },
        {
            "last_affected": "1.0.0-milestone11"
        },
        {
            "introduced": "1.0.0-milestone12"
        },
        {
            "last_affected": "1.0.0-milestone12"
        },
        {
            "introduced": "1.0.0-milestone13"
        },
        {
            "last_affected": "1.0.0-milestone13"
        },
        {
            "introduced": "1.0.0-milestone14"
        },
        {
            "last_affected": "1.0.0-milestone14"
        },
        {
            "introduced": "1.0.0-milestone15"
        },
        {
            "last_affected": "1.0.0-milestone15"
        },
        {
            "introduced": "1.0.0-milestone16"
        },
        {
            "last_affected": "1.0.0-milestone16"
        },
        {
            "introduced": "1.0.0-milestone17"
        },
        {
            "last_affected": "1.0.0-milestone17"
        },
        {
            "introduced": "1.0.0-milestone18"
        },
        {
            "last_affected": "1.0.0-milestone18"
        },
        {
            "introduced": "1.0.0-milestone19"
        },
        {
            "last_affected": "1.0.0-milestone19"
        },
        {
            "introduced": "1.0.0-milestone2"
        },
        {
            "last_affected": "1.0.0-milestone2"
        },
        {
            "introduced": "1.0.0-milestone20"
        },
        {
            "last_affected": "1.0.0-milestone20"
        },
        {
            "introduced": "1.0.0-milestone21"
        },
        {
            "last_affected": "1.0.0-milestone21"
        },
        {
            "introduced": "1.0.0-milestone22"
        },
        {
            "last_affected": "1.0.0-milestone22"
        },
        {
            "introduced": "1.0.0-milestone23"
        },
        {
            "last_affected": "1.0.0-milestone23"
        },
        {
            "introduced": "1.0.0-milestone24"
        },
        {
            "last_affected": "1.0.0-milestone24"
        },
        {
            "introduced": "1.0.0-milestone25"
        },
        {
            "last_affected": "1.0.0-milestone25"
        },
        {
            "introduced": "1.0.0-milestone26"
        },
        {
            "last_affected": "1.0.0-milestone26"
        },
        {
            "introduced": "1.0.0-milestone27"
        },
        {
            "last_affected": "1.0.0-milestone27"
        },
        {
            "introduced": "1.0.0-milestone28"
        },
        {
            "last_affected": "1.0.0-milestone28"
        },
        {
            "introduced": "1.0.0-milestone29"
        },
        {
            "last_affected": "1.0.0-milestone29"
        },
        {
            "introduced": "1.0.0-milestone3"
        },
        {
            "last_affected": "1.0.0-milestone3"
        },
        {
            "introduced": "1.0.0-milestone30"
        },
        {
            "last_affected": "1.0.0-milestone30"
        },
        {
            "introduced": "1.0.0-milestone31"
        },
        {
            "last_affected": "1.0.0-milestone31"
        },
        {
            "introduced": "1.0.0-milestone32"
        },
        {
            "last_affected": "1.0.0-milestone32"
        },
        {
            "introduced": "1.0.0-milestone33"
        },
        {
            "last_affected": "1.0.0-milestone33"
        },
        {
            "introduced": "1.0.0-milestone34"
        },
        {
            "last_affected": "1.0.0-milestone34"
        },
        {
            "introduced": "1.0.0-milestone35"
        },
        {
            "last_affected": "1.0.0-milestone35"
        },
        {
            "introduced": "1.0.0-milestone36"
        },
        {
            "last_affected": "1.0.0-milestone36"
        },
        {
            "introduced": "1.0.0-milestone37"
        },
        {
            "last_affected": "1.0.0-milestone37"
        },
        {
            "introduced": "1.0.0-milestone38"
        },
        {
            "last_affected": "1.0.0-milestone38"
        },
        {
            "introduced": "1.0.0-milestone39"
        },
        {
            "last_affected": "1.0.0-milestone39"
        },
        {
            "introduced": "1.0.0-milestone4"
        },
        {
            "last_affected": "1.0.0-milestone4"
        },
        {
            "introduced": "1.0.0-milestone40"
        },
        {
            "last_affected": "1.0.0-milestone40"
        },
        {
            "introduced": "1.0.0-milestone41"
        },
        {
            "last_affected": "1.0.0-milestone41"
        },
        {
            "introduced": "1.0.0-milestone42"
        },
        {
            "last_affected": "1.0.0-milestone42"
        },
        {
            "introduced": "1.0.0-milestone43"
        },
        {
            "last_affected": "1.0.0-milestone43"
        },
        {
            "introduced": "1.0.0-milestone44"
        },
        {
            "last_affected": "1.0.0-milestone44"
        },
        {
            "introduced": "1.0.0-milestone5"
        },
        {
            "last_affected": "1.0.0-milestone5"
        },
        {
            "introduced": "1.0.0-milestone6"
        },
        {
            "last_affected": "1.0.0-milestone6"
        },
        {
            "introduced": "1.0.0-milestone7"
        },
        {
            "last_affected": "1.0.0-milestone7"
        },
        {
            "introduced": "1.0.0-milestone8"
        },
        {
            "last_affected": "1.0.0-milestone8"
        },
        {
            "introduced": "1.0.0-milestone9"
        },
        {
            "last_affected": "1.0.0-milestone9"
        }
    ]
}

Affected versions

1.*

1.0.0-milestone1

1.0.0-milestone10

1.0.0-milestone11

1.0.0-milestone12

1.0.0-milestone13

1.0.0-milestone14

1.0.0-milestone15

1.0.0-milestone16

1.0.0-milestone17

1.0.0-milestone18

1.0.0-milestone19

1.0.0-milestone2

1.0.0-milestone20

1.0.0-milestone21

1.0.0-milestone22

1.0.0-milestone23

1.0.0-milestone24

1.0.0-milestone25

1.0.0-milestone26

1.0.0-milestone27

1.0.0-milestone28

1.0.0-milestone29

1.0.0-milestone3

1.0.0-milestone30

1.0.0-milestone31

1.0.0-milestone32

1.0.0-milestone33

1.0.0-milestone34

1.0.0-milestone35

1.0.0-milestone36

1.0.0-milestone37

1.0.0-milestone38

1.0.0-milestone39

1.0.0-milestone4

1.0.0-milestone40

1.0.0-milestone41

1.0.0-milestone42

1.0.0-milestone43

1.0.0-milestone44

1.0.0-milestone5

1.0.0-milestone6

1.0.0-milestone7

1.0.0-milestone8

1.0.0-milestone9

v0.*

v0.23.0

v0.23.0-M1

v0.23.1

v0.23.10

v0.23.11

v0.23.12

v0.23.13

v0.23.14

v0.23.15

v0.23.16

v0.23.18

v0.23.19

v0.23.19-RC1

v0.23.19-RC2

v0.23.2

v0.23.20

v0.23.22

v0.23.23

v0.23.24

v0.23.25

v0.23.26

v0.23.27

v0.23.28

v0.23.29

v0.23.3

v0.23.30

v0.23.5

v0.23.6

v0.23.7

v0.23.8

v0.23.9

v1.*

v1.0.0-M1

v1.0.0-M10

v1.0.0-M11

v1.0.0-M12

v1.0.0-M13

v1.0.0-M15

v1.0.0-M16

v1.0.0-M17

v1.0.0-M19

v1.0.0-M2

v1.0.0-M20

v1.0.0-M21

v1.0.0-M3

v1.0.0-M4

v1.0.0-M5

v1.0.0-M6

v1.0.0-M7

v1.0.0-M8

v1.0.0-M9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59822.json"