{"id":"CVE-2021-41084","published":"2021-09-21T17:20:14Z","modified":"2024-08-04T02:59:31Z","title":"Response Splitting from unsanitized headers in http4s","vendor":"http4s","product":"http4s","tier":"tail","description":{"text":"http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01235,"percentile":0.69057,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8","tags":["x_refsource_MISC"]},{"url":"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values","tags":["x_refsource_MISC"]},{"url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting","tags":["x_refsource_MISC"]}],"priority":{"score":19.9,"factors":[{"name":"EPSS percentile","points":13.81},{"name":"CVSS severity","points":6.09}]},"vendorSlug":"http4s","affectedVersions":[{"vendor":"http4s","product":"http4s","versions":["<= 0.21.28",">= 0.22.0, < 0.22.5",">= 0.23.0, < 0.23.4",">= 1.0.0-M1, < 1.0.0-M27"]}],"affected":[{"ecosystem":"Maven","package":"org.http4s:http4s-client_2.12","vulnerableRanges":["<0.21.29",">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.21.29","0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-client_2.13","vulnerableRanges":["<0.21.29",">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.21.29","0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-client_3","vulnerableRanges":["<0.21.29",">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.21.29","0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.10","vulnerableRanges":["<=0.21.28"],"patched":[],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.11","vulnerableRanges":["<=0.21.28"],"patched":[],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.12","vulnerableRanges":["<0.21.29",">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.21.29","0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.13","vulnerableRanges":["<0.21.29",">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.21.29","0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.13.0-M5","vulnerableRanges":["<=0.21.28"],"patched":[],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.http4s:http4s-server_3","vulnerableRanges":[">=0.22.0, <0.22.5",">=0.23.0, <0.23.4"],"patched":["0.22.5","0.23.4"],"from":["GHSA-5vcm-3xc3-w7x3"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1987","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-5280","published":"2020-03-25","fixed":"0.21.2","kev":false},{"cve":"CVE-2021-39185","published":"2021-09-01","fixed":"0.23.2","kev":false,"link":{"from":"CVE-2021-39185","to":"CVE-2021-41084","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.http4s:http4s-server_2.12","fromFixed":"0.23.2","toFixed":"0.23.4","daysApart":20},{"kind":"version-step","provenance":"source","package":"Maven:org.http4s:http4s-server_2.12","fromFixed":"0.21.27","toFixed":"0.21.29","daysApart":20}]}},{"cve":"CVE-2021-41084","published":"2021-09-21","fixed":"0.23.4","kev":false},{"cve":"CVE-2026-69201","published":"2026-09-15","fixed":"0.23.35","kev":false}],"package":"Maven:org.http4s:http4s-server_2.12"}}