---
id: CVE-2026-69212
title: Http4s is a Scala interface for HTTP services
summary: >-
  Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47,
  The FollowRedirect client middleware strips Authorization and Cookie headers
  only when a redirect changes authority, but authority comparison excludes the
  URI…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-319
vendor: http4s
product: http4s
affected:
  - http4s < 0.23.35
  - 'http4s >= 1.0.0-M1, < 1.0.0-M47'
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:38:04.943'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69212'
references:
  - url: >-
      https://github.com/http4s/http4s/commit/6e825719b8d2f1538f2c49089c2dc81321a833b4
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v0.23.35'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v1.0.0-M47'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/security/advisories/GHSA-2rgg-r783-mrx4'
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
  - cve.org
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/c0gnit00/CVE-2026-69212'
  checkedAt: '2026-09-25T08:21:09.323Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T19:30:31.142631Z'
ingestedAt: '2026-09-15T19:42:58.804Z'
epss: 0.00279
epssPercentile: 0.1812
---

## Overview

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP therefore preserves credentials and transmits them over a plaintext connection. An attacker who can induce the downgrade and observe the network can capture those sensitive headers from applications using FollowRedirect. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.