CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product http4s:http4s. Show all products

19 CVEs, showing 1 to 19
CVESeverityTitlePublished
CVE-2026-88975High 7.5Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69206Medium 5.9Http4s: DigestAuth allows replay of captured requests
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69202High 7.5Http4s Ember HTTP/2: unbounded inbound body buffering
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69218High 7.5Http4s Ember HTTP/2: unbounded continuation frame accumulation
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69203High 7.5Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69217High 8.7Http4s: Ember Server accepts duplicate Content-Length headers
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69210High 7.5Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69215Medium 6.8Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69205High 8.7Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69212Medium 5.9Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69213High 7.5Http4s Ember HTTP/2: unbounded outbound frame queue
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69214Medium 6.8Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69201Medium 5.9Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69216Medium 5.4Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69211Medium 4.8Http4s: Set-Cookie rendering does not escape attribute delimiters
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69209High 7.5Http4s: WebSocket decoder accepts unbounded message sizes
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69208High 7.5Http4s: DigestAuth nonce map grows unbounded
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-69204Critical 9.2Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
Assigned by GitHub_M
Sep 15, 2026
CVE-2026-54556High 8.2Http4s: HTTP/2 Denial of Service with Ember Backend
Assigned by GitHub_M
Aug 26, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.