Every CVE whose affected-product data names Typelevel Http4s, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (7)
CVE-2021-39185 — CVSS 9.1 (critical): Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0…
CVE-2021-41084 — CVSS 8.7 (high): http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting…
CVE-2020-5280 — CVSS 7.6 (high): http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of…
CVE-2021-21294 — CVSS 7.5 (high): Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and…
CVE-2023-22465 — CVSS 7.5 (high): Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38…
CVE-2025-59822 — CVSS 7.5 (high): Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to…
CVE-2021-32643 — CVSS 5.8 (medium): Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme…