CVE-2021-39185

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-39185

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39185.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-39185

Aliases

GHSA-52cf-226f-rhr6

Published

2021-09-01T20:15:07Z

Modified

2026-10-20T10:54:53Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original CORS implementation and CORSConfig are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

Last Affected

6264fa05386925afd82942976f5606b1d8181099

Introduced

3e98ea4a63e741c7f9d5e917d48d2ee8fab54476

Last Affected

cf77cfeb2d0bd09337da0b64a636e29bbfb77d27

Introduced

06db471f053023ce3ffd7c568ce46d33551d1d69

Last Affected

6676c1e24a4e32e0c6c1a36911f4e6606c10e12b

Fixed

5ebfb746ff98817959cbcce3ab2520342253c608

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.21.26"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0"
                },
                {
                    "last_affected":  "0.22.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.23.0"
                },
                {
                    "last_affected":  "0.23.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.23.1"
                },
                {
                    "last_affected":  "0.23.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone1"
                },
                {
                    "last_affected":  "1.0.0-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone10"
                },
                {
                    "last_affected":  "1.0.0-milestone10"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone11"
                },
                {
                    "last_affected":  "1.0.0-milestone11"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone12"
                },
                {
                    "last_affected":  "1.0.0-milestone12"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone13"
                },
                {
                    "last_affected":  "1.0.0-milestone13"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone14"
                },
                {
                    "last_affected":  "1.0.0-milestone14"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone15"
                },
                {
                    "last_affected":  "1.0.0-milestone15"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone16"
                },
                {
                    "last_affected":  "1.0.0-milestone16"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone17"
                },
                {
                    "last_affected":  "1.0.0-milestone17"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone18"
                },
                {
                    "last_affected":  "1.0.0-milestone18"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone19"
                },
                {
                    "last_affected":  "1.0.0-milestone19"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone2"
                },
                {
                    "last_affected":  "1.0.0-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone20"
                },
                {
                    "last_affected":  "1.0.0-milestone20"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone21"
                },
                {
                    "last_affected":  "1.0.0-milestone21"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone22"
                },
                {
                    "last_affected":  "1.0.0-milestone22"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone23"
                },
                {
                    "last_affected":  "1.0.0-milestone23"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone24"
                },
                {
                    "last_affected":  "1.0.0-milestone24"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone3"
                },
                {
                    "last_affected":  "1.0.0-milestone3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone4"
                },
                {
                    "last_affected":  "1.0.0-milestone4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone5"
                },
                {
                    "last_affected":  "1.0.0-milestone5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone6"
                },
                {
                    "last_affected":  "1.0.0-milestone6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone7"
                },
                {
                    "last_affected":  "1.0.0-milestone7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone8"
                },
                {
                    "last_affected":  "1.0.0-milestone8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone9"
                },
                {
                    "last_affected":  "1.0.0-milestone9"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "original_tag":  "v0.23.2",
            "range":  [
                {
                    "fixed":  "5ebfb746ff98817959cbcce3ab2520342253c608"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.23.0

0.23.1

1.*

1.0.0-milestone1

1.0.0-milestone10

1.0.0-milestone11

1.0.0-milestone12

1.0.0-milestone13

1.0.0-milestone14

1.0.0-milestone15

1.0.0-milestone16

1.0.0-milestone17

1.0.0-milestone18

1.0.0-milestone19

1.0.0-milestone2

1.0.0-milestone20

1.0.0-milestone21

1.0.0-milestone22

1.0.0-milestone23

1.0.0-milestone24

1.0.0-milestone3

1.0.0-milestone4

1.0.0-milestone5

1.0.0-milestone6

1.0.0-milestone7

1.0.0-milestone8

1.0.0-milestone9

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.17.0-M1

v0.18.0

v0.18.0-M1

v0.18.0-M2

v0.18.0-M3

v0.18.0-M4

v0.18.0-M5

v0.18.0-M6

v0.18.0-M7

v0.18.0-M8

v0.18.0-M9

v0.19.0

v0.19.0-M1

v0.19.0-M2

v0.19.0-M3

v0.2.0

v0.20.0

v0.20.0-M1

v0.20.0-M2

v0.20.0-M3

v0.20.0-M4

v0.20.0-M5

v0.20.0-M6

v0.20.0-M7

v0.20.0-RC1

v0.21.0

v0.21.0-M1

v0.21.0-M3

v0.21.0-M4

v0.21.0-M5

v0.21.0-M6

v0.21.0-RC1

v0.21.0-RC2

v0.21.0-RC3

v0.21.0-RC4

v0.21.0-RC5

v0.21.1

v0.21.11

v0.21.12

v0.21.13

v0.21.14

v0.21.15

v0.21.16

v0.21.18

v0.21.19

v0.21.20

v0.21.21

v0.21.22

v0.21.23

v0.21.25

v0.21.26

v0.21.3

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.21.8

v0.21.9

v0.23.0

v0.23.1

v0.3.0

v0.5.0

v0.6.0

v0.7.0

v0.8.1

v0.9.0

v1.*

v1.0.0-M1

v1.0.0-M2

v1.0.0-M3

v1.0.0-M4

v1.0.0-M5

v1.0.0-M6

v1.0.0-M7

v1.0.0-M8

v1.0.0-M9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39185.json"