CVE-2026-69201: Http4s Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-crq5-92j2-j7wv",
  "modified" : "2026-09-15T20:01:13Z",
  "published" : "2026-09-15T20:01:12Z",
  "aliases" : [ "CVE-2026-69201" ],
  "summary" : "Http4s: ResourceService and Webjar Service path escape via percent-encoded separators",
  "details" : "The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segments that are exactly `\"\"`, `\".\"`, or `\"..\"`.  A percent-encoded separator (`%2F`) lets an attacker smuggle a `../` segment past that filter and escape the configured base, reading resources that should not be public.\n\nOn Windows, a similar attack exists with (`%5C`).\n\n## Impact\n\nDisclosure of classpath or webjar resources outside the configured base.\n\n## Preconditions\n\n- Application uses `ResourceService` (with a non-root base path) or `WebjarService`\n- At least one classpath entry is served from a directory (e.g. `sbt run`, exploded .war)\n- Backend forwards `%2F`/`%5C` without normalizing (e.g., Ember, Blaze)\n\n## Fixes\n\nThe patch rejects any decoded path segment containing `/` (`%2F`) or `\\` (`%5C`) with a `400 Bad Request` in `ResourceService` and `WebjarService`.\n\n`FileService` was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.\n\n## Workarounds\n\n- Deploy as a fat jar, with no filesystem directories on the classpath.\n- Front the service with a proxy that rejects/normalizes `%2F` and `%5C` in the request path.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-server_2.12"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-server_2.13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-server_3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-server_3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0-M1"
      }, {
        "fixed" : "1.0.0-M47"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.0-M46"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-server_2.13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0-M1"
      }, {
        "fixed" : "1.0.0-M47"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.0-M46"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/http4s/http4s"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/releases/tag/v0.23.35"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-15T20:01:12Z",
    "nvd_published_at" : null
  }
}