Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-59822

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-23 Sep, 2025 | 18:54
Updated At-23 Sep, 2025 | 19:17
Rejected At-
Credits

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–ĽCommon Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:23 Sep, 2025 | 18:54
Updated At:23 Sep, 2025 | 19:17
Rejected At:
â–ĽCVE Numbering Authority (CNA)
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Affected Products
Vendor
http4s
Product
http4s
Versions
Affected
  • < 0.23.31
  • >= 1.0.0-M1, < 1.0.0-M45
Problem Types
TypeCWE IDDescription
CWECWE-444CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Type: CWE
CWE ID: CWE-444
Description: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Metrics
VersionBase scoreBase severityVector
4.06.3MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
x_refsource_CONFIRM
https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41
x_refsource_MISC
Hyperlink: https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41
Resource:
x_refsource_MISC
â–ĽAuthorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
exploit
Hyperlink: https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
Resource:
exploit
Information is not available yet
â–ĽNational Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:23 Sep, 2025 | 19:15
Updated At:08 Oct, 2025 | 17:35

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.06.3MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Type: Secondary
Version: 4.0
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CPE Matches

typelevel
typelevel
>>http4s>>Versions before 0.23.31(exclusive)
cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*
typelevel
typelevel
>>http4s>>1.0.0
cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-444Secondarysecurity-advisories@github.com
CWE ID: CWE-444
Type: Secondary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41security-advisories@github.com
Patch
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrrsecurity-advisories@github.com
Exploit
Vendor Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Vendor Advisory
Hyperlink: https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
Source: security-advisories@github.com
Resource:
Exploit
Vendor Advisory
Hyperlink: https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource:
Exploit
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

55Records found

CVE-2020-7238
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.50% / 81.31%
||
7 Day CHG~0.00%
Published-27 Jan, 2020 | 16:43
Updated-04 Aug, 2024 | 09:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Action-Not Available
Vendor-n/aThe Netty ProjectDebian GNU/LinuxFedora ProjectRed Hat, Inc.
Product-debian_linuxnettyfedorajboss_enterprise_application_platformopenshift_application_runtimes_text-only_advisoriesjboss_enterprise_application_platform_text-only_advisoriesn/a
CWE ID-CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2020-7659
Matching Score-4
Assigner-Snyk
ShareView Details
Matching Score-4
Assigner-Snyk
CVSS Score-7.5||HIGH
EPSS-0.10% / 26.18%
||
7 Day CHG~0.00%
Published-01 Jun, 2020 | 12:50
Updated-04 Aug, 2024 | 09:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more.

Action-Not Available
Vendor-celluloidn/a
Product-reelreel
CWE ID-CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2020-25613
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.27% / 50.59%
||
7 Day CHG~0.00%
Published-06 Oct, 2020 | 00:00
Updated-04 Aug, 2024 | 15:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Action-Not Available
Vendor-n/aFedora ProjectRuby
Product-fedorarubywebrickn/a
CWE ID-CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2023-46589
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-7.5||HIGH
EPSS-59.51% / 98.27%
||
7 Day CHG+1.62%
Published-28 Nov, 2023 | 15:31
Updated-29 Oct, 2025 | 12:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache Tomcat: HTTP request smuggling via malformed trailer headers

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Action-Not Available
Vendor-The Apache Software Foundation
Product-tomcatApache Tomcattomcat
CWE ID-CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2020-10111
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.50% / 66.22%
||
7 Day CHG~0.00%
Published-06 Mar, 2020 | 20:33
Updated-04 Aug, 2024 | 11:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. Citrix ADC only caches HTTP/1.1 traffic for performance optimization

Action-Not Available
Vendor-n/aCitrix (Cloud Software Group, Inc.)
Product-gateway_firmwaren/a
CWE ID-CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  • Previous
  • 1
  • 2
  • Next
Details not found