CVE-2025-59822

Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31.

• CWE-444

• https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41Patch
• https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrrExploit, Vendor Advisory
• https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrrExploit, Vendor Advisory

Published

Sep 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59817This vulnerability allows attackers to execute arbitrary com…8.4
• CVE-2025-59818This vulnerability allows authenticated attackers to execute…9.8
• CVE-2025-59819This vulnerability allows authenticated attackers to read an…6.5
• CVE-2025-5982An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2025-59820In KDE Krita before 5.2.13, loading a manipulated TGA file c…6.7
• CVE-2025-59821DNN (formerly DotNetNuke) is an open-source web content mana…6.1
• CVE-2025-59823Project Gardener implements the automated management and ope…9.9
• CVE-2025-59824Omni manages Kubernetes on bare metal, virtual machines, or …5.4
• CVE-2025-59825astral-tokio-tar is a tar archive reading/writing library fo…6.1
• CVE-2025-59826Flag Forge is a Capture The Flag (CTF) platform. In version …7.6
• CVE-2025-59827Flag Forge is a Capture The Flag (CTF) platform. In version …9.8
• CVE-2025-59828Claude Code is an agentic coding tool. Prior to Claude Code …9.8