CVE-2026-69201Medium· 5.9▾ SunlitHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request contai…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base when a directory-backed classpath is served and the backend preserves the encoded separator. The patch rejects decoded segments containing slash or backslash in ResourceService and WebjarService, and applies the same guard to the non-exploitable FileService for consistency. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.http4s:http4s-server_2.12 <= 0.23.34org.http4s:http4s-server_2.13 <= 0.23.34org.http4s:http4s-server_3 <= 0.23.34org.http4s:http4s-server_3 >= 1.0.0-M1, <= 1.0.0-M46org.http4s:http4s-server_2.13 >= 1.0.0-M1, <= 1.0.0-M46Patched in:
org.http4s:http4s-server_2.12 0.23.35org.http4s:http4s-server_2.13 0.23.35org.http4s:http4s-server_3 0.23.35org.http4s:http4s-server_3 1.0.0-M47org.http4s:http4s-server_2.13 1.0.0-M47Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69215Medium· 6.8Http4s is a Scala interface for HTTP services
CVE-2026-69218High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69206Medium· 5.9Http4s is a Scala interface for HTTP services
CVE-2026-69205High· 8.7Http4s is a Scala interface for HTTP services
CVE-2026-69203High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69202High· 7.5Http4s is a Scala interface for HTTP services