CVE-2023-22465highCWE-20

CVE-2023-22465: fallo de gravedad alta en http4s

Http4s has fatal error parsing User-Agent and Server headers

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear http4s+ Monitorear org.http4s:http4s-core

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.9%
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
http4s · http4s
CVEs relacionadas — http4s

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5280HIGHLocal file inclusion vulnerability in http4sEPSS 7.0%CVE-2021-21294HIGHUnbounded connection acceptance in http4s-blaze-serverEPSS 2.2%CVE-2021-32643MEDIUMStaticFile.fromUrl can leak presence of a directoryEPSS 1.4%CVE-2021-41084HIGHResponse Splitting from unsanitized headers in http4sEPSS 1.2%CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2026-69201MEDIUMHttp4s: ResourceService and Webjar Service path escape via percent-encoded separatorsEPSS 0.8%