CVE-2025-59822: Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section

September 23, 2025 (updated November 10, 2025)

http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to:

Bypass front-end servers security controls
Launch targeted attacks against active users
Poison web caches

Pre-requisites for the exploitation: the web appication has to be deployed behind a reverse-proxy that forwards trailer headers.

References

github.com/advisories/GHSA-wcwh-7gfw-5wrr
github.com/http4s/http4s
github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41
github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr
nvd.nist.gov/vuln/detail/CVE-2025-59822

Code Behaviors & Features

Detect and mitigate CVE-2025-59822 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →