CVE-2023-22465

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-22465

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22465.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-22465

Aliases

GHSA-54w6-vxfh-fw7f

Published

2023-01-04T15:30:04.129Z

Modified

2026-07-15T02:08:01.436734417Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Http4s has fatal error parsing User-Agent and Server headers

Details

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22465.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

1cb3dd7d66767ad02f6431d290ca14c07ec99c30

Fixed

f09ae5a20f23798f10537dc3684b614d0c454fea

Introduced

3e98ea4a63e741c7f9d5e917d48d2ee8fab54476

Fixed

3eade0b5c8d6a8271444604760912c861807d0b9

Introduced

06db471f053023ce3ffd7c568ce46d33551d1d69

Fixed

cc61c693e4f78d84f77f0ac8e7f6431fe72f4cc4

Introduced

756ce63aee681c5b632bbeafe0b8fde2f3d237f4

Last affected

6676c1e24a4e32e0c6c1a36911f4e6606c10e12b

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.21.34"
        },
        {
            "introduced": "0.22.0"
        },
        {
            "fixed": "0.22.15"
        },
        {
            "introduced": "0.23.0"
        },
        {
            "fixed": "0.23.17"
        },
        {
            "introduced": "1.0.0-milestone1"
        },
        {
            "last_affected": "1.0.0-milestone1"
        },
        {
            "introduced": "1.0.0-milestone10"
        },
        {
            "last_affected": "1.0.0-milestone10"
        },
        {
            "introduced": "1.0.0-milestone11"
        },
        {
            "last_affected": "1.0.0-milestone11"
        },
        {
            "introduced": "1.0.0-milestone12"
        },
        {
            "last_affected": "1.0.0-milestone12"
        },
        {
            "introduced": "1.0.0-milestone13"
        },
        {
            "last_affected": "1.0.0-milestone13"
        },
        {
            "introduced": "1.0.0-milestone14"
        },
        {
            "last_affected": "1.0.0-milestone14"
        },
        {
            "introduced": "1.0.0-milestone15"
        },
        {
            "last_affected": "1.0.0-milestone15"
        },
        {
            "introduced": "1.0.0-milestone16"
        },
        {
            "last_affected": "1.0.0-milestone16"
        },
        {
            "introduced": "1.0.0-milestone17"
        },
        {
            "last_affected": "1.0.0-milestone17"
        },
        {
            "introduced": "1.0.0-milestone18"
        },
        {
            "last_affected": "1.0.0-milestone18"
        },
        {
            "introduced": "1.0.0-milestone19"
        },
        {
            "last_affected": "1.0.0-milestone19"
        },
        {
            "introduced": "1.0.0-milestone2"
        },
        {
            "last_affected": "1.0.0-milestone2"
        },
        {
            "introduced": "1.0.0-milestone20"
        },
        {
            "last_affected": "1.0.0-milestone20"
        },
        {
            "introduced": "1.0.0-milestone21"
        },
        {
            "last_affected": "1.0.0-milestone21"
        },
        {
            "introduced": "1.0.0-milestone22"
        },
        {
            "last_affected": "1.0.0-milestone22"
        },
        {
            "introduced": "1.0.0-milestone23"
        },
        {
            "last_affected": "1.0.0-milestone23"
        },
        {
            "introduced": "1.0.0-milestone24"
        },
        {
            "last_affected": "1.0.0-milestone24"
        },
        {
            "introduced": "1.0.0-milestone25"
        },
        {
            "last_affected": "1.0.0-milestone25"
        },
        {
            "introduced": "1.0.0-milestone26"
        },
        {
            "last_affected": "1.0.0-milestone26"
        },
        {
            "introduced": "1.0.0-milestone27"
        },
        {
            "last_affected": "1.0.0-milestone27"
        },
        {
            "introduced": "1.0.0-milestone28"
        },
        {
            "last_affected": "1.0.0-milestone28"
        },
        {
            "introduced": "1.0.0-milestone29"
        },
        {
            "last_affected": "1.0.0-milestone29"
        },
        {
            "introduced": "1.0.0-milestone3"
        },
        {
            "last_affected": "1.0.0-milestone3"
        },
        {
            "introduced": "1.0.0-milestone30"
        },
        {
            "last_affected": "1.0.0-milestone30"
        },
        {
            "introduced": "1.0.0-milestone31"
        },
        {
            "last_affected": "1.0.0-milestone31"
        },
        {
            "introduced": "1.0.0-milestone32"
        },
        {
            "last_affected": "1.0.0-milestone32"
        },
        {
            "introduced": "1.0.0-milestone33"
        },
        {
            "last_affected": "1.0.0-milestone33"
        },
        {
            "introduced": "1.0.0-milestone34"
        },
        {
            "last_affected": "1.0.0-milestone34"
        },
        {
            "introduced": "1.0.0-milestone35"
        },
        {
            "last_affected": "1.0.0-milestone35"
        },
        {
            "introduced": "1.0.0-milestone36"
        },
        {
            "last_affected": "1.0.0-milestone36"
        },
        {
            "introduced": "1.0.0-milestone37"
        },
        {
            "last_affected": "1.0.0-milestone37"
        },
        {
            "introduced": "1.0.0-milestone4"
        },
        {
            "last_affected": "1.0.0-milestone4"
        },
        {
            "introduced": "1.0.0-milestone5"
        },
        {
            "last_affected": "1.0.0-milestone5"
        },
        {
            "introduced": "1.0.0-milestone6"
        },
        {
            "last_affected": "1.0.0-milestone6"
        },
        {
            "introduced": "1.0.0-milestone7"
        },
        {
            "last_affected": "1.0.0-milestone7"
        },
        {
            "introduced": "1.0.0-milestone8"
        },
        {
            "last_affected": "1.0.0-milestone8"
        },
        {
            "introduced": "1.0.0-milestone9"
        },
        {
            "last_affected": "1.0.0-milestone9"
        }
    ],
    "cpe": [
        "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*"
    ]
}

Affected versions

1.*

1.0.0-milestone1

1.0.0-milestone10

1.0.0-milestone11

1.0.0-milestone12

1.0.0-milestone13

1.0.0-milestone14

1.0.0-milestone15

1.0.0-milestone16

1.0.0-milestone17

1.0.0-milestone18

1.0.0-milestone19

1.0.0-milestone2

1.0.0-milestone20

1.0.0-milestone21

1.0.0-milestone22

1.0.0-milestone23

1.0.0-milestone24

1.0.0-milestone25

1.0.0-milestone26

1.0.0-milestone27

1.0.0-milestone28

1.0.0-milestone29

1.0.0-milestone3

1.0.0-milestone30

1.0.0-milestone31

1.0.0-milestone32

1.0.0-milestone33

1.0.0-milestone34

1.0.0-milestone35

1.0.0-milestone36

1.0.0-milestone37

1.0.0-milestone4

1.0.0-milestone5

1.0.0-milestone6

1.0.0-milestone7

1.0.0-milestone8

1.0.0-milestone9

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.17.0-M1

v0.18.0

v0.18.0-M1

v0.18.0-M2

v0.18.0-M3

v0.18.0-M4

v0.18.0-M5

v0.18.0-M6

v0.18.0-M7

v0.18.0-M8

v0.18.0-M9

v0.19.0

v0.19.0-M1

v0.19.0-M2

v0.19.0-M3

v0.2.0

v0.20.0

v0.20.0-M1

v0.20.0-M2

v0.20.0-M3

v0.20.0-M4

v0.20.0-M5

v0.20.0-M6

v0.20.0-M7

v0.20.0-RC1

v0.21.0

v0.21.0-M1

v0.21.0-M3

v0.21.0-M4

v0.21.0-M5

v0.21.0-M6

v0.21.0-RC1

v0.21.0-RC2

v0.21.0-RC3

v0.21.0-RC4

v0.21.0-RC5

v0.21.1

v0.21.11

v0.21.12

v0.21.13

v0.21.14

v0.21.15

v0.21.16

v0.21.18

v0.21.19

v0.21.20

v0.21.21

v0.21.22

v0.21.23

v0.21.25

v0.21.26

v0.21.27

v0.21.28

v0.21.3

v0.21.30

v0.21.31

v0.21.32

v0.21.33

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.21.8

v0.21.9

v0.22.0-M1

v0.22.0-M3

v0.22.0-M5

v0.22.0-M6

v0.22.0-M7

v0.22.0-M8

v0.22.1

v0.22.10

v0.22.11

v0.22.12

v0.22.13

v0.22.14

v0.22.2

v0.22.3

v0.22.4

v0.22.6

v0.22.7

v0.22.8

v0.22.9

v0.23.0

v0.23.1

v0.23.10

v0.23.11

v0.23.12

v0.23.13

v0.23.14

v0.23.15

v0.23.16

v0.23.2

v0.23.3

v0.23.5

v0.23.6

v0.23.7

v0.23.8

v0.23.9

v0.3.0

v0.5.0

v0.6.0

v0.7.0

v0.8.1

v0.9.0

v1.*

v1.0.0-M1

v1.0.0-M10

v1.0.0-M2

v1.0.0-M3

v1.0.0-M4

v1.0.0-M5

v1.0.0-M6

v1.0.0-M7

v1.0.0-M8

v1.0.0-M9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22465.json"