| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-09-29 | 4.2 kB | |
| v0.23.38 source code.tar.gz | 2026-09-29 | 898.9 kB | |
| v0.23.38 source code.zip | 2026-09-29 | 1.6 MB | |
| Totals: 3 Items | 2.5 MB | 0 | |
Security fixes
GHSA-jc8x-g44q-5x7j: CookieJar accepts public-suffixDomainattributes (e.g.Domain=.com), enabling cross-origin cookie injectionGHSA-674r-3w4m-554c: Server-Sent Events injection in http4sServerSentEventrendering: multi-line fields are not split or escaped per the WHATWG specificationGHSA-f9r9-f7c2-m95p: Unbounded part count in the default implicitEntityDecoder[Multipart[F]]allows remote memory exhaustion (DoS) via ~9-byte empty partsGHSA-j56h-2225-92vh: WSClient.connectHighLevel defrag unbounded accumulation causes client OOM denial of serviceGHSA-pgwq-c7vg-8jj5: Ember HTTP/2: CONTINUATION fragment count is not constrained allowing unbounded memory growthGHSA-xg73-pp4c-h9g6: CookieJar stores cookies in an unbounded, non-expiring map, allowing a remote server to exhaust client memoryGHSA-xmmj-wgv7-x3pq: Ember HTTP/1 parser folds a bare LF into a header value, enabling CL.0 request smugglingGHSA-53ph-fr68-m7r9: Ember HTTP/2 server connection can deadlock when request body is not consumedGHSA-m75g-6h7r-j48h: WebjarService.apply(config) (deprecated) still vulnerable to percent-encoded separator path escape - incomplete fix of GHSA-crq5-92j2-j7wvGHSA-qjwj-gvvp-8qrc: CookieJar sends a host-only cookie (Set-Cookie without Domain) to every subdomainGHSA-mf7r-59rg-r2cj: Ember HTTP/1.1 client response parser accepts Transfer-Encoding combined with Content-Length (client-side response smuggling)
What else changed
http4s-core
- Reject unmasked WS frames on the server by @danicheg in https://github.com/http4s/http4s/pull/7950
- Include framing header for empty 205 response by @reardonj in https://github.com/http4s/http4s/pull/7951
http4s-ember-core
- Properly signal the start of an Ember Unix socket server by @rossabaker in https://github.com/http4s/http4s/pull/7941
- Normalize empty ALPN protocol in Ember by @miciek in https://github.com/http4s/http4s/pull/7963
Behind the scenes
* Update scala3-library, ... to 3.3.8 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7865
* Update http4s-circe, http4s-ember-client to 0.23.37 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7944
* Update netty-buffer, netty-codec-http to 4.2.18.Final in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7946
* Add AI restriction to CONTRIBUTING.md by @reardonj in https://github.com/http4s/http4s/pull/7949
* Update sbt-buildinfo to 0.13.2 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7952
* Update jnr-unixsocket to 0.39.5 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7953
* Update sbt-native-packager to 1.12.0 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7958
* Update munit-cats-effect to 2.2.1 in series/0.23 by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7960
* flake.lock: Update by @http4s-steward[bot] in https://github.com/http4s/http4s/pull/7962
New Contributors
- @miciek made their first contribution in https://github.com/http4s/http4s/pull/7963
Full Changelog: https://github.com/http4s/http4s/compare/v0.23.37...v0.23.38
