CVE-2021-41084highCWE-918

CVE-2021-41084: falha de alta gravidade em http4s

Response Splitting from unsanitized headers in http4s

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar http4s+ Monitorar org.http4s:http4s-server_2.12

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 1.2%
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
http4s · http4s
CVEs relacionadas — http4s

No mesmo produto, das mais perigosas para as menos.

CVE-2020-5280HIGHLocal file inclusion vulnerability in http4sEPSS 7.0%CVE-2021-21294HIGHUnbounded connection acceptance in http4s-blaze-serverEPSS 2.2%CVE-2021-32643MEDIUMStaticFile.fromUrl can leak presence of a directoryEPSS 1.4%CVE-2023-22465HIGHHttp4s has fatal error parsing User-Agent and Server headersEPSS 0.9%CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2026-69201MEDIUMHttp4s: ResourceService and Webjar Service path escape via percent-encoded separatorsEPSS 0.8%