Threat Investigation
Request a demo

CVE-2021-41084

High

Description

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

SeverityHigh
CVSS8.7
Exploit probability—
ProductTypelevel Http4s
PublishedSep 21, 2021
First seenSep 21, 2021
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • typelevel http4s0.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-client_2.120.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-client_2.130.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-client_30.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-server_2.120.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-server_2.130.21.29, 0.22.5, 0.23.4 or later
  • org.http4s:http4s-server_30.22.5, 0.23.4 or later

Affected products

ProductAffected versionsFixed in
typelevel http4sv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.4, 1.0.00.21.29, 0.22.5, 0.23.4
org.http4s:http4s-client_2.12Mavenv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.21.29, 0.22.5, 0.23.4
org.http4s:http4s-client_2.13Mavenv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.21.29, 0.22.5, 0.23.4
org.http4s:http4s-client_3Mavenv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.21.29, 0.22.5, 0.23.4
org.http4s:http4s-server_2.10Mavenv ≤ 0.21.28—
org.http4s:http4s-server_2.11Mavenv ≤ 0.21.28—
org.http4s:http4s-server_2.12Mavenv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.21.29, 0.22.5, 0.23.4
org.http4s:http4s-server_2.13Mavenv < 0.21.29, 0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.21.29, 0.22.5, 0.23.4
org.http4s:http4s-server_2.13.0-M5Mavenv ≤ 0.21.28—
org.http4s:http4s-server_3Maven0.22.0 ≤ v < 0.22.5, 0.23.0 ≤ v < 0.23.40.22.5, 0.23.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.