CVE-2026-69201

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base when a directory-backed classpath is served and the backend preserves the encoded separator. The patch rejects decoded segments containing slash or backslash in ResourceService and WebjarService, and applies the same guard to the non-exploitable FileService for consistency. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

• CWE-22

• https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3
• https://github.com/http4s/http4s/releases/tag/v0.23.35
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
• https://github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69190Graylog is a free and open log management platform. From 6.3…6.3
• CVE-2026-69192ip-address is a library for parsing and manipulating IPv4 an…7.7
• CVE-2026-69197Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.…8.7
• CVE-2026-69198ip-address is a library for parsing and manipulating IPv4 an…6.9
• CVE-2026-6920Out of bounds read in GPU in Google Chrome on Android prior …9.6
• CVE-2026-69200node-opcua is an OPC UA implementation for TypeScript and No…3.7
• CVE-2026-69202Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69203Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69204Http4s is a Scala interface for HTTP services. Prior to 0.23…9.2
• CVE-2026-69205Http4s is a Scala interface for HTTP services. Prior to 0.23…8.7
• CVE-2026-69206Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9
• CVE-2026-69207Hono is a Web application framework that provides support fo…5.3