CVE-2025-59822 - CVE House
Back to Database
Status published Medium CVE-2025-59822

Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

Vulnerability Description

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59822

Credits & Attribution

No credits recorded in the NVD database.

References

More from http4s

View All →
CVE-2023-22465
Http4s has fatal error parsing User-Agent and Server headers
High 7.5
CVE-2021-41084
Response Splitting from unsanitized headers in http4s
High 8.7
CVE-2021-39185
Default CORS config allows any origin with credentials
Critical 9.1
CVE-2021-32643
StaticFile.fromUrl can leak presence of a directory
Medium 5.8
CVE-2021-21294
Unbounded connection acceptance in http4s-blaze-server
High 7.5

Affected Vendor

Affected Software

http4s
Vulnerable Versions:
< 0.23.31, >= 1.0.0-M1, < 1.0.0-M45

Timeline

Official Publish: September 23rd, 2025
Last Modified: September 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion