CVE-2021-39185

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-39185

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39185.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-39185

Aliases

GHSA-52cf-226f-rhr6

Published

2021-09-01T20:15:07.447Z

Modified

2026-07-09T10:52:20.589461Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original CORS implementation and CORSConfig are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

Last affected

6264fa05386925afd82942976f5606b1d8181099

Introduced

3e98ea4a63e741c7f9d5e917d48d2ee8fab54476

Last affected

cf77cfeb2d0bd09337da0b64a636e29bbfb77d27

Introduced

06db471f053023ce3ffd7c568ce46d33551d1d69

Last affected

6676c1e24a4e32e0c6c1a36911f4e6606c10e12b

Fixed

5ebfb746ff98817959cbcce3ab2520342253c608

Database specific

{
    "cpe": [
        "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.21.26"
        },
        {
            "introduced": "0.22.0"
        },
        {
            "last_affected": "0.22.2"
        },
        {
            "introduced": "0.23.0"
        },
        {
            "last_affected": "0.23.0"
        },
        {
            "introduced": "0.23.1"
        },
        {
            "last_affected": "0.23.1"
        },
        {
            "introduced": "1.0.0-milestone1"
        },
        {
            "last_affected": "1.0.0-milestone1"
        },
        {
            "introduced": "1.0.0-milestone10"
        },
        {
            "last_affected": "1.0.0-milestone10"
        },
        {
            "introduced": "1.0.0-milestone11"
        },
        {
            "last_affected": "1.0.0-milestone11"
        },
        {
            "introduced": "1.0.0-milestone12"
        },
        {
            "last_affected": "1.0.0-milestone12"
        },
        {
            "introduced": "1.0.0-milestone13"
        },
        {
            "last_affected": "1.0.0-milestone13"
        },
        {
            "introduced": "1.0.0-milestone14"
        },
        {
            "last_affected": "1.0.0-milestone14"
        },
        {
            "introduced": "1.0.0-milestone15"
        },
        {
            "last_affected": "1.0.0-milestone15"
        },
        {
            "introduced": "1.0.0-milestone16"
        },
        {
            "last_affected": "1.0.0-milestone16"
        },
        {
            "introduced": "1.0.0-milestone17"
        },
        {
            "last_affected": "1.0.0-milestone17"
        },
        {
            "introduced": "1.0.0-milestone18"
        },
        {
            "last_affected": "1.0.0-milestone18"
        },
        {
            "introduced": "1.0.0-milestone19"
        },
        {
            "last_affected": "1.0.0-milestone19"
        },
        {
            "introduced": "1.0.0-milestone2"
        },
        {
            "last_affected": "1.0.0-milestone2"
        },
        {
            "introduced": "1.0.0-milestone20"
        },
        {
            "last_affected": "1.0.0-milestone20"
        },
        {
            "introduced": "1.0.0-milestone21"
        },
        {
            "last_affected": "1.0.0-milestone21"
        },
        {
            "introduced": "1.0.0-milestone22"
        },
        {
            "last_affected": "1.0.0-milestone22"
        },
        {
            "introduced": "1.0.0-milestone23"
        },
        {
            "last_affected": "1.0.0-milestone23"
        },
        {
            "introduced": "1.0.0-milestone24"
        },
        {
            "last_affected": "1.0.0-milestone24"
        },
        {
            "introduced": "1.0.0-milestone3"
        },
        {
            "last_affected": "1.0.0-milestone3"
        },
        {
            "introduced": "1.0.0-milestone4"
        },
        {
            "last_affected": "1.0.0-milestone4"
        },
        {
            "introduced": "1.0.0-milestone5"
        },
        {
            "last_affected": "1.0.0-milestone5"
        },
        {
            "introduced": "1.0.0-milestone6"
        },
        {
            "last_affected": "1.0.0-milestone6"
        },
        {
            "introduced": "1.0.0-milestone7"
        },
        {
            "last_affected": "1.0.0-milestone7"
        },
        {
            "introduced": "1.0.0-milestone8"
        },
        {
            "last_affected": "1.0.0-milestone8"
        },
        {
            "introduced": "1.0.0-milestone9"
        },
        {
            "last_affected": "1.0.0-milestone9"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.23.0

0.23.1

1.*

1.0.0-milestone1

1.0.0-milestone10

1.0.0-milestone11

1.0.0-milestone12

1.0.0-milestone13

1.0.0-milestone14

1.0.0-milestone15

1.0.0-milestone16

1.0.0-milestone17

1.0.0-milestone18

1.0.0-milestone19

1.0.0-milestone2

1.0.0-milestone20

1.0.0-milestone21

1.0.0-milestone22

1.0.0-milestone23

1.0.0-milestone24

1.0.0-milestone3

1.0.0-milestone4

1.0.0-milestone5

1.0.0-milestone6

1.0.0-milestone7

1.0.0-milestone8

1.0.0-milestone9

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.17.0-M1

v0.18.0

v0.18.0-M1

v0.18.0-M2

v0.18.0-M3

v0.18.0-M4

v0.18.0-M5

v0.18.0-M6

v0.18.0-M7

v0.18.0-M8

v0.18.0-M9

v0.19.0

v0.19.0-M1

v0.19.0-M2

v0.19.0-M3

v0.2.0

v0.20.0

v0.20.0-M1

v0.20.0-M2

v0.20.0-M3

v0.20.0-M4

v0.20.0-M5

v0.20.0-M6

v0.20.0-M7

v0.20.0-RC1

v0.21.0

v0.21.0-M1

v0.21.0-M3

v0.21.0-M4

v0.21.0-M5

v0.21.0-M6

v0.21.0-RC1

v0.21.0-RC2

v0.21.0-RC3

v0.21.0-RC4

v0.21.0-RC5

v0.21.1

v0.21.11

v0.21.12

v0.21.13

v0.21.14

v0.21.15

v0.21.16

v0.21.18

v0.21.19

v0.21.20

v0.21.21

v0.21.22

v0.21.23

v0.21.25

v0.21.26

v0.21.3

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.21.8

v0.21.9

v0.22.0-M1

v0.22.0-M3

v0.22.0-M5

v0.22.0-M6

v0.22.0-M7

v0.22.0-M8

v0.22.1

v0.22.2

v0.23.0

v0.23.1

v0.3.0

v0.5.0

v0.6.0

v0.7.0

v0.8.1

v0.9.0

v1.*

v1.0.0-M1

v1.0.0-M10

v1.0.0-M2

v1.0.0-M3

v1.0.0-M4

v1.0.0-M5

v1.0.0-M6

v1.0.0-M7

v1.0.0-M8

v1.0.0-M9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39185.json"