CVE-2026-69201: Http4s ResourceService and Webjar Service Path Escape Vulnerability
Summary
CVE-2026-69201: Http4s: ResourceService and Webjar Service path escape via percent-encoded separators. Affects org.http4s:http4s-server_2.12 versions < 0.23.35. Fixed in 0.23.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Http4s is a popular open-source library for building HTTP services in Scala. It provides a range of features for creating web applications, including static content handling through ResourceService and WebjarService. These services are designed to serve static resources from a specified base path. However, a vulnerability exists that allows attackers to bypass security restrictions and access unauthorized resources.
Vulnerability Detail
The vulnerability arises from the way ResourceService and WebjarService handle URL decoding of path segments. They only reject segments that are exactly "", ".", or ".." after decoding. This allows an attacker to use percent-encoded separators (%2F for forward slash and %5C for backslash) to smuggle a "../" segment past the filter, enabling them to escape the configured base path and access sensitive resources that should not be publicly available. On Windows systems, the same issue exists with backslashes, which can lead to unauthorized disclosure of classpath or webjar resources.
How To Fix
Latest published version: 1.0-57-0368053 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.35
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can deploy your application as a fat jar, which eliminates the need for filesystem directories on the classpath. Additionally, consider using a proxy server that can reject or normalize requests containing percent-encoded separators (%2F and %5C) in the request path.
Conclusion
CVE-2026-69201 represents a significant security risk for applications using the Http4s library due to improper handling of URL path segments. It is crucial to update to the latest patched versions to mitigate this vulnerability and protect sensitive resources from unauthorized access.
See every vulnerability recorded for org.http4s:http4s-server_2.12 →
FAQ
CVE-2026-69201 is a vulnerability in the Http4s library that allows attackers to bypass security restrictions and access unauthorized resources through path escape techniques.
Affected versions include org.http4s:http4s-server_2.12, org.http4s:http4s-server_2.13, and org.http4s:http4s-server_3 up to version 0.23.34 and 1.0.0-M46.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without requiring code access or installation.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of severity.
If immediate patching is not possible, consider implementing the suggested workarounds, such as deploying as a fat jar or using a proxy server to filter out malicious requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.http4s:http4s-server_2.12.
