Maven/org.http4s:http4s-server_2.12 CVE-2026-69201: medium 5.9, EPSS 0.76%

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Action: Upgrade org.http4s:http4s-server_2.12 to 0.23.35 or later.

Affected

Fixed versions

Sources

• osv: GHSA-crq5-92j2-j7wv
• https://github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv
• https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3
• https://github.com/http4s/http4s
• https://github.com/http4s/http4s/releases/tag/v0.23.35
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M47

CVE-2026-69201 · published 2026-09-15T20:01:12Z · modified 2026-09-15T20:15:05.103669257Z · JSON