Download Latest Version
v0.23.36 source code.zip (1.5 MB)
Get an email when there's a new version of Http4s
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-07-04 | 7.6 kB | |
| v0.23.35 source code.tar.gz | 2026-07-04 | 861.3 kB | |
| v0.23.35 source code.zip | 2026-07-04 | 1.5 MB | |
| Totals: 3 Items | 2.4 MB | 0 | |
This is a security hardening release that comes as a result of two independent scans. Upgrades are strongly encouraged if you are:
- Running Ember HTTP/2
- Running behind an unhardened proxy
- Exposing websocket endpoints to the public
- Using
DigestAuthorFollowRedirectmiddleware - Using
staticcontentservices
Security fixes
GHSA-crq5-92j2-j7wv: ResourceService and Webjar Service path escape via percent-encoded separatorsGHSA-vmm3-xgcx-67hm: Ember HTTP/2: Denial of Service via HPACK bombGHSA-cp4q-fqw9-4hf6: Ember HTTP/2: unbounded continuation frame accumulationGHSA-p83c-4wj9-p6w9: Ember Server accepts duplicate Content-Length headersGHSA-jrpm-956j-96jg: Ember chunk parser lenience (TE.TE request smuggling) (github.com)GHSA-grh8-3p95-f9rr: CookieJar middleware matches by substring, leaking cookies cross-originGHSA-wv64-j4fq-5f9x: CookieJar middleware accepts arbitrary Set-Cookie domainGHSA-8f3q-3jmv-7prw: Ember HTTP/2: unbounded outbound frame queueGHSA-2rgg-r783-mrx4: FollowRedirect middleware leaks credentials over https->http same-authority redirectGHSA-7qh7-rghh-698h: Set-Cookie rendering does not escape attribute delimitersGHSA-3j86-pj9g-jchr: WebSocket decoder accepts negative length, causing infinite decode loopGHSA-jrxx-w2m8-5hf5: WebSocket decoder accepts unbounded message sizesGHSA-fm4g-76c9-7w69: DigestAuth nonce map grows unboundedGHSA-9xww-74xv-gjfp: DigestAuth allows replay of captured requestsDigestAuth allows replay of captured requestsGHSA-9998-894r-fwvr: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (github.com)GHSA-8h4c-x2wg-6xp8: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (github.com)GHSA-9vwc-pc8p-253q: Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMSGHSA-6m4x-pp6q-5jmm: Ember HTTP/2: unbounded inbound body buffering
What Else Has Changed
http4s-server
- Add safer wildcard method to VirtualHost by @reardonj in https://github.com/http4s/http4s/pull/7850
http4s-ember-core
- Avoid stack trace computation for
EmberException.EmptyStreamby @mrdziuban in https://github.com/http4s/http4s/pull/7851 - Separately send the trailing end_stream in H2Stream by @bcarter97 in https://github.com/http4s/http4s/pull/7830
http4s-ember-client
- Improve connection reuse with configurable drain parameters by @rossabaker in https://github.com/http4s/http4s/pull/7853
User-facing upgrades
- Update scodec-bits to 1.2.5 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7833
- Update scala-java-time to 2.7.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7867
- Update jawn-parser to 1.7.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7876
- Update jawn-fs2 to 2.6.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7878
- Update circe-core, circe-generic, ... to 0.14.16 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7877
- Update jnr-unixsocket to 0.39.1 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7880
Behind the scenes
* Update munit to 1.3.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7820
* Update scalafmt-core to 3.11.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7821
* Update doctest-runtime, sbt-doctest to 0.12.5 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7822
* Update http4s-circe, http4s-ember-client to 0.23.34 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7819
* flake.lock: Update by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7827
* Update sbt, scripted-plugin to 1.12.10 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7829
* Update sbt, scripted-plugin to 1.12.11 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7831
* Update netty-buffer, netty-codec-http to 4.2.13.Final in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7832
* Update scalafmt-core to 3.11.1 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7834
* flake.lock: Update by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7852
* Update netty-buffer, netty-codec-http to 4.2.14.Final in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7854
* Update sbt-http4s-org to 2.0.6 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7855
* Update munit to 1.3.1 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7859
* Update munit to 1.3.2 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7862
* Update netty-buffer, netty-codec-http to 4.2.15.Final in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7861
* Update munit to 1.3.3 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7863
* Update auxlib, clib, javalib, nativelib, ... to 0.5.12 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7856
* Update sbt, scripted-plugin to 1.12.12 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7868
* flake.lock: Update by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7871
* Update sbt, scripted-plugin to 1.12.13 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7873
* flake.lock: Update by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7875
Special thanks
@rossabaker would like to thank:
- @reardonj and @ERobertGII for their security analysis and mitigations
- @samspills, @morgen-peschke, and @OddKristensen for reviewing the mitigations
New Contributors
- @bcarter97 made their first contribution in https://github.com/http4s/http4s/pull/7830
Full Changelog: https://github.com/http4s/http4s/compare/v0.23.34...v0.23.35