CVE-2025-59822

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59822", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-22T14:34:03.470Z", "datePublished": "2025-09-23T18:54:42.867Z", "dateUpdated": "2025-09-23T19:17:26.320Z"}, "containers": {"cna": {"title": "Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr"}, {"name": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41"}], "affected": [{"vendor": "http4s", "product": "http4s", "versions": [{"version": "< 0.23.31", "status": "affected"}, {"version": ">= 1.0.0-M1, < 1.0.0-M45", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-23T18:54:42.867Z"}, "descriptions": [{"lang": "en", "value": "Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31."}], "source": {"advisory": "GHSA-wcwh-7gfw-5wrr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T19:15:00.938453Z", "id": "CVE-2025-59822", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:17:26.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59822", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T19:15:00.938453Z"}}}], "references": [{"url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:15:06.063Z"}}], "cna": {"title": "Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section", "source": {"advisory": "GHSA-wcwh-7gfw-5wrr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "http4s", "product": "http4s", "versions": [{"status": "affected", "version": "< 0.23.31"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M45"}]}], "references": [{"url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr", "name": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41", "name": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-23T18:54:42.867Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59822", "state": "PUBLISHED", "dateUpdated": "2025-09-23T19:17:26.320Z", "dateReserved": "2025-09-22T14:34:03.470Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-23T18:54:42.867Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "http4s", "vendor": "http4s", "versions": [{"status": "affected", "version": "< 0.23.31"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M45"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*", "matchCriteriaId": "861A0064-65E6-4742-8A82-2942BCCAA03B", "versionEndExcluding": "0.23.31", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*", "matchCriteriaId": "65C497F9-281C-4565-BD36-B6B4D7E6F8BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*", "matchCriteriaId": "6FCFC3E5-7530-4AAA-A2C7-36DC307B613B", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*", "matchCriteriaId": "D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*", "matchCriteriaId": "76F8BC53-544C-4285-8D9B-CB91AD080048", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*", "matchCriteriaId": "778947CA-20BA-469F-87E1-97D8713ACC75", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*", "matchCriteriaId": "F5B02828-1E40-49BE-8367-10296625C696", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*", "matchCriteriaId": "A569F32F-3C8C-4F8F-B0BC-6ADC993596A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*", "matchCriteriaId": "525DBF4B-F574-459D-9CE2-6AF597ABAE10", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*", "matchCriteriaId": "FD05B15E-1E4F-43EA-B21A-3B96A77814D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*", "matchCriteriaId": "65C79F52-F05F-4F0A-AC27-393197B9EF00", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*", "matchCriteriaId": "A426B4C0-643A-492F-B7FB-725549F613F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*", "matchCriteriaId": "D95E231C-3D13-45FC-AF9A-CB8CF1FFC983", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*", "matchCriteriaId": "CF973F58-0AC7-4B58-A2CF-654133CE7F1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*", "matchCriteriaId": "35C40331-C96C-477C-B6BD-D5506E612DA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*", "matchCriteriaId": "615BC827-3E0F-4C1E-8FD2-B59FF31F2D49", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*", "matchCriteriaId": "FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*", "matchCriteriaId": "97F74D04-031E-47D4-BA57-DBE9C74CE256", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*", "matchCriteriaId": "2FDC2E12-DE86-4A82-BD2F-C18F715CA673", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*", "matchCriteriaId": "C1C18467-5FD0-4DCC-8B75-979C03BFF1C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*", "matchCriteriaId": "6724B3CF-A393-469B-BA80-CED8AB98358A", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*", "matchCriteriaId": "804EF10D-46A9-49C0-B1C4-74B832115662", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*", "matchCriteriaId": "2DE365D6-17C4-4E82-8F2B-1DA18CC8382F", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*", "matchCriteriaId": "DE093D65-1B3A-4A4A-BC76-05DEF9529712", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*", "matchCriteriaId": "078E27D3-AD80-44E8-A97C-328AEB4E2929", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*", "matchCriteriaId": "548DB4B7-872D-4A7E-9DA7-D0BF15BDE969", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*", "matchCriteriaId": "07037A73-F463-4F8B-8F8B-AF513B31DA21", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*", "matchCriteriaId": "801D2731-BD6D-4CD9-B69F-75DC1A0FE3CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*", "matchCriteriaId": "AA2C32F3-93A3-4A2F-9A9A-DC06056EDC81", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*", "matchCriteriaId": "59C3ECBA-47D1-4A9B-8193-8033BC27CC37", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*", "matchCriteriaId": "9B7AF9D4-4548-4D25-84BC-54C525179342", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*", "matchCriteriaId": "0D884D1D-F74D-406F-A363-C008097C997E", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone38:*:*:*:*:*:*", "matchCriteriaId": "25F8BDE8-DBA8-484A-B3D5-01F1883E8BE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone39:*:*:*:*:*:*", "matchCriteriaId": "BF4C693D-8E32-4DAC-9CB9-515949E196BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*", "matchCriteriaId": "DC3CA618-148D-4F97-9913-316DDDD97838", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone40:*:*:*:*:*:*", "matchCriteriaId": "0F0BBAE2-5280-4F1E-880D-15865D9D056E", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone41:*:*:*:*:*:*", "matchCriteriaId": "42658BAE-1610-42B3-BC9A-E0C1AB0A1DEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone42:*:*:*:*:*:*", "matchCriteriaId": "E1361DEE-C784-44B8-88E8-9FD34AA4EA3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone43:*:*:*:*:*:*", "matchCriteriaId": "1573CA36-84F2-4053-AB10-A9EA3E96F806", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone44:*:*:*:*:*:*", "matchCriteriaId": "A8266609-3342-4E37-8518-1B83F41AFE52", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*", "matchCriteriaId": "02FA538C-9D8A-49D5-8268-1A2C3E96B89B", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*", "matchCriteriaId": "D18A3ABC-5C47-45BF-978C-5BB17787DCFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "1CE1CF51-E61A-418A-AB22-9D7A6D690BAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*", "matchCriteriaId": "29A70AAA-B77A-4291-A700-C910362DB8D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*", "matchCriteriaId": "9F8F3C38-57AB-4CBC-8959-7FF51CBA7907", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31."}, {"lang": "es", "value": "Http4s es una interfaz Scala para servicios HTTP. En versiones desde la 1.0.0-M1 hasta antes de la 1.0.0-M45 y antes de la 0.23.31, http4s es vulnerable a HTTP Request Smuggling debido a un manejo inadecuado de la secci\u00f3n de tr\u00e1iler HTTP. Esta vulnerabilidad podr\u00eda permitir a los atacantes eludir los controles de seguridad de los servidores front-end, lanzar ataques dirigidos contra usuarios activos y envenenar las cach\u00e9s web. Un prerrequisito para la explotaci\u00f3n implica que la aplicaci\u00f3n web est\u00e9 desplegada detr\u00e1s de un proxy inverso que reenv\u00eda los encabezados de tr\u00e1iler. Este problema ha sido parcheado en las versiones 1.0.0-M45 y 0.23.31."}], "id": "CVE-2025-59822", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59822", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-23T19:15:00.938453Z", "version": "2.0.3"}}]}, "published": "2025-09-23T19:15:42.303", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-25T08:22:14.055432+00:00", "updated": "2025-09-25T08:22:14.055489+00:00", "vendors": ["http4s", "http4s$PRODUCT$http4s"]}