CVE-2025-59822: http4s before 0.23.31 (exclusive), 1.0.0 · update milestone1, 1.0.0 · update milestone10 (+43 more affected versions)

Affected technology

http4s · before 0.23.31 (exclusive)
typelevel

http4s · 1.0.0 · update milestone1
typelevel

http4s · 1.0.0 · update milestone10
typelevel

http4s · 1.0.0 · update milestone11
typelevel

http4s · 1.0.0 · update milestone12
typelevel

http4s · 1.0.0 · update milestone13
typelevel

http4s · 1.0.0 · update milestone14
typelevel

http4s · 1.0.0 · update milestone15
typelevel

http4s · 1.0.0 · update milestone16
typelevel

http4s · 1.0.0 · update milestone17
typelevel

http4s · 1.0.0 · update milestone18
typelevel

http4s · 1.0.0 · update milestone19
typelevel

http4s · 1.0.0 · update milestone2
typelevel

http4s · 1.0.0 · update milestone20
typelevel

http4s · 1.0.0 · update milestone21
typelevel

http4s · 1.0.0 · update milestone22
typelevel

http4s · 1.0.0 · update milestone23
typelevel

http4s · 1.0.0 · update milestone24
typelevel

http4s · 1.0.0 · update milestone25
typelevel

http4s · 1.0.0 · update milestone26
typelevel

http4s · 1.0.0 · update milestone27
typelevel

http4s · 1.0.0 · update milestone28
typelevel

http4s · 1.0.0 · update milestone29
typelevel

http4s · 1.0.0 · update milestone3
typelevel

http4s · 1.0.0 · update milestone30
typelevel

http4s · 1.0.0 · update milestone31
typelevel

http4s · 1.0.0 · update milestone32
typelevel

http4s · 1.0.0 · update milestone33
typelevel

http4s · 1.0.0 · update milestone34
typelevel

http4s · 1.0.0 · update milestone35
typelevel

http4s · 1.0.0 · update milestone36
typelevel

http4s · 1.0.0 · update milestone37
typelevel

http4s · 1.0.0 · update milestone38
typelevel

http4s · 1.0.0 · update milestone39
typelevel

http4s · 1.0.0 · update milestone4
typelevel

http4s · 1.0.0 · update milestone40
typelevel

http4s · 1.0.0 · update milestone41
typelevel

http4s · 1.0.0 · update milestone42
typelevel

http4s · 1.0.0 · update milestone43
typelevel

http4s · 1.0.0 · update milestone44
typelevel

http4s · 1.0.0 · update milestone5
typelevel

http4s · 1.0.0 · update milestone6
typelevel

http4s · 1.0.0 · update milestone7
typelevel

http4s · 1.0.0 · update milestone8
typelevel

http4s · 1.0.0 · update milestone9
typelevel

http4s · < 0.23.31, >= 1.0.0-M1, < 1.0.0-M45
http4s

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.