CVE-2019-17598: Lightbend Play Framework

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.

Affected products

• Lightbend Play Framework: from 2.5.0, up to and including 2.5.19; from 2.6.0, up to and including 2.6.23

Published 2019-11-05. Last modified 2026-06-17.