CVE-2025-59822 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

What is CVE-2025-59822?

CVE-2025-59822 is a medium-severity vulnerability in http4s, published on 23 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Weakness: CWE-444

Which versions are affected by CVE-2025-59822?

10 open source packages ship an affected version, including org.http4s:http4s-ember-core_2.13, org.http4s:http4s-ember-core_2.12 and org.http4s:http4s-ember-core_3. It affects 1 product.

Products include Typelevel Http4s.

How do I fix CVE-2025-59822?

Upgrade org.http4s:http4s-ember-core_2.13 to a fixed version for your release line: 0.23.31 or 1.0.0-M45.

Is CVE-2025-59822 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59822 exists.

Other vulnerabilities in http4s

• CVE-2021-39185 Default CORS config allows any origin with credentials Critical 9.1
• CVE-2021-41084 Response Splitting from unsanitized headers in http4s High 8.7
• CVE-2020-5280 Local file inclusion vulnerability in http4s High 7.6
• CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers High 7.5
• CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wcwh-7gfw-5wrr.