CVE-2021-41084

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-41084

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41084.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-41084

Aliases

GHSA-5vcm-3xc3-w7x3

Published

2021-09-21T18:15:07Z

Modified

2026-10-20T10:54:57Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (Header.nameå), Header values (Header.value), Status reason phrases (Status.reason), URI paths (Uri.Path), URI authority registered names (URI.RegName) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

Fixed

214e217a2c87579deb7682e4d42f190b1060d950

Introduced

3e98ea4a63e741c7f9d5e917d48d2ee8fab54476

Fixed

4695eb16773b4ee9ed37b2f0d51d4ded16772779

Introduced

06db471f053023ce3ffd7c568ce46d33551d1d69

Fixed

1bdc15f793865c92008b6a4d76d1ce818be27ac9

Introduced

756ce63aee681c5b632bbeafe0b8fde2f3d237f4

Last Affected

6676c1e24a4e32e0c6c1a36911f4e6606c10e12b

Fixed

d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.21.29"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0"
                },
                {
                    "fixed":  "0.22.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.23.0"
                },
                {
                    "fixed":  "0.23.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone1"
                },
                {
                    "last_affected":  "1.0.0-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone10"
                },
                {
                    "last_affected":  "1.0.0-milestone10"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone11"
                },
                {
                    "last_affected":  "1.0.0-milestone11"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone12"
                },
                {
                    "last_affected":  "1.0.0-milestone12"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone13"
                },
                {
                    "last_affected":  "1.0.0-milestone13"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone14"
                },
                {
                    "last_affected":  "1.0.0-milestone14"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone15"
                },
                {
                    "last_affected":  "1.0.0-milestone15"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone16"
                },
                {
                    "last_affected":  "1.0.0-milestone16"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone17"
                },
                {
                    "last_affected":  "1.0.0-milestone17"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone18"
                },
                {
                    "last_affected":  "1.0.0-milestone18"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone19"
                },
                {
                    "last_affected":  "1.0.0-milestone19"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone2"
                },
                {
                    "last_affected":  "1.0.0-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone20"
                },
                {
                    "last_affected":  "1.0.0-milestone20"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone21"
                },
                {
                    "last_affected":  "1.0.0-milestone21"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone22"
                },
                {
                    "last_affected":  "1.0.0-milestone22"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone23"
                },
                {
                    "last_affected":  "1.0.0-milestone23"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone24"
                },
                {
                    "last_affected":  "1.0.0-milestone24"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone25"
                },
                {
                    "last_affected":  "1.0.0-milestone25"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone26"
                },
                {
                    "last_affected":  "1.0.0-milestone26"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone3"
                },
                {
                    "last_affected":  "1.0.0-milestone3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone4"
                },
                {
                    "last_affected":  "1.0.0-milestone4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone5"
                },
                {
                    "last_affected":  "1.0.0-milestone5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone6"
                },
                {
                    "last_affected":  "1.0.0-milestone6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone7"
                },
                {
                    "last_affected":  "1.0.0-milestone7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone8"
                },
                {
                    "last_affected":  "1.0.0-milestone8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone9"
                },
                {
                    "last_affected":  "1.0.0-milestone9"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.0.0-milestone1

1.0.0-milestone10

1.0.0-milestone11

1.0.0-milestone12

1.0.0-milestone13

1.0.0-milestone14

1.0.0-milestone15

1.0.0-milestone16

1.0.0-milestone17

1.0.0-milestone18

1.0.0-milestone19

1.0.0-milestone2

1.0.0-milestone20

1.0.0-milestone21

1.0.0-milestone22

1.0.0-milestone23

1.0.0-milestone24

1.0.0-milestone25

1.0.0-milestone26

1.0.0-milestone3

1.0.0-milestone4

1.0.0-milestone5

1.0.0-milestone6

1.0.0-milestone7

1.0.0-milestone8

1.0.0-milestone9

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.17.0-M1

v0.18.0

v0.18.0-M1

v0.18.0-M2

v0.18.0-M3

v0.18.0-M4

v0.18.0-M5

v0.18.0-M6

v0.18.0-M7

v0.18.0-M8

v0.18.0-M9

v0.19.0

v0.19.0-M1

v0.19.0-M2

v0.19.0-M3

v0.2.0

v0.20.0

v0.20.0-M1

v0.20.0-M2

v0.20.0-M3

v0.20.0-M4

v0.20.0-M5

v0.20.0-M6

v0.20.0-M7

v0.20.0-RC1

v0.21.0

v0.21.0-M1

v0.21.0-M3

v0.21.0-M4

v0.21.0-M5

v0.21.0-M6

v0.21.0-RC1

v0.21.0-RC2

v0.21.0-RC3

v0.21.0-RC4

v0.21.0-RC5

v0.21.1

v0.21.11

v0.21.12

v0.21.13

v0.21.14

v0.21.15

v0.21.16

v0.21.18

v0.21.19

v0.21.20

v0.21.21

v0.21.22

v0.21.23

v0.21.25

v0.21.26

v0.21.27

v0.21.28

v0.21.3

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.21.8

v0.21.9

v0.3.0

v0.5.0

v0.6.0

v0.7.0

v0.8.1

v0.9.0

v1.*

v1.0.0-M1

v1.0.0-M2

v1.0.0-M3

v1.0.0-M4

v1.0.0-M5

v1.0.0-M6

v1.0.0-M7

v1.0.0-M8

v1.0.0-M9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41084.json"