CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 71.9%

CVSS Severity

CVSS v3 Score 8.7

CVSS v2 Score 4.3

References

Products affected by CVE-2021-41084

Typelevel » Http4s » Version: 0.1.0

cpe:2.3:a:typelevel:http4s:0.1.0
Typelevel » Http4s » Version: 0.1.1

cpe:2.3:a:typelevel:http4s:0.1.1
Typelevel » Http4s » Version: 0.10.0

cpe:2.3:a:typelevel:http4s:0.10.0
Typelevel » Http4s » Version: 0.10.1

cpe:2.3:a:typelevel:http4s:0.10.1
Typelevel » Http4s » Version: 0.11.0

cpe:2.3:a:typelevel:http4s:0.11.0
Typelevel » Http4s » Version: 0.11.1

cpe:2.3:a:typelevel:http4s:0.11.1
Typelevel » Http4s » Version: 0.11.2

cpe:2.3:a:typelevel:http4s:0.11.2
Typelevel » Http4s » Version: 0.11.3

cpe:2.3:a:typelevel:http4s:0.11.3
Typelevel » Http4s » Version: 0.12.0

cpe:2.3:a:typelevel:http4s:0.12.0
Typelevel » Http4s » Version: 0.12.1

cpe:2.3:a:typelevel:http4s:0.12.1
Typelevel » Http4s » Version: 0.12.2

cpe:2.3:a:typelevel:http4s:0.12.2
Typelevel » Http4s » Version: 0.12.3

cpe:2.3:a:typelevel:http4s:0.12.3
Typelevel » Http4s » Version: 0.12.4

cpe:2.3:a:typelevel:http4s:0.12.4
Typelevel » Http4s » Version: 0.12.5

cpe:2.3:a:typelevel:http4s:0.12.5
Typelevel » Http4s » Version: 0.12.6

cpe:2.3:a:typelevel:http4s:0.12.6
Typelevel » Http4s » Version: 0.13.0

cpe:2.3:a:typelevel:http4s:0.13.0
Typelevel » Http4s » Version: 0.13.1

cpe:2.3:a:typelevel:http4s:0.13.1
Typelevel » Http4s » Version: 0.13.2

cpe:2.3:a:typelevel:http4s:0.13.2
Typelevel » Http4s » Version: 0.13.3

cpe:2.3:a:typelevel:http4s:0.13.3
Typelevel » Http4s » Version: 0.14.0

cpe:2.3:a:typelevel:http4s:0.14.0
Typelevel » Http4s » Version: 0.14.1

cpe:2.3:a:typelevel:http4s:0.14.1
Typelevel » Http4s » Version: 0.14.10

cpe:2.3:a:typelevel:http4s:0.14.10
Typelevel » Http4s » Version: 0.14.11

cpe:2.3:a:typelevel:http4s:0.14.11
Typelevel » Http4s » Version: 0.14.2

cpe:2.3:a:typelevel:http4s:0.14.2
Typelevel » Http4s » Version: 0.14.3

cpe:2.3:a:typelevel:http4s:0.14.3
Typelevel » Http4s » Version: 0.14.4

cpe:2.3:a:typelevel:http4s:0.14.4
Typelevel » Http4s » Version: 0.14.5

cpe:2.3:a:typelevel:http4s:0.14.5
Typelevel » Http4s » Version: 0.14.6

cpe:2.3:a:typelevel:http4s:0.14.6
Typelevel » Http4s » Version: 0.14.7

cpe:2.3:a:typelevel:http4s:0.14.7
Typelevel » Http4s » Version: 0.14.8

cpe:2.3:a:typelevel:http4s:0.14.8
Typelevel » Http4s » Version: 0.14.9

cpe:2.3:a:typelevel:http4s:0.14.9
Typelevel » Http4s » Version: 0.15.0

cpe:2.3:a:typelevel:http4s:0.15.0
Typelevel » Http4s » Version: 0.15.1

cpe:2.3:a:typelevel:http4s:0.15.1
Typelevel » Http4s » Version: 0.15.10

cpe:2.3:a:typelevel:http4s:0.15.10
Typelevel » Http4s » Version: 0.15.11

cpe:2.3:a:typelevel:http4s:0.15.11
Typelevel » Http4s » Version: 0.15.12

cpe:2.3:a:typelevel:http4s:0.15.12
Typelevel » Http4s » Version: 0.15.13

cpe:2.3:a:typelevel:http4s:0.15.13
Typelevel » Http4s » Version: 0.15.14

cpe:2.3:a:typelevel:http4s:0.15.14
Typelevel » Http4s » Version: 0.15.15

cpe:2.3:a:typelevel:http4s:0.15.15
Typelevel » Http4s » Version: 0.15.16

cpe:2.3:a:typelevel:http4s:0.15.16
Typelevel » Http4s » Version: 0.15.2

cpe:2.3:a:typelevel:http4s:0.15.2
Typelevel » Http4s » Version: 0.15.3

cpe:2.3:a:typelevel:http4s:0.15.3
Typelevel » Http4s » Version: 0.15.4

cpe:2.3:a:typelevel:http4s:0.15.4
Typelevel » Http4s » Version: 0.15.5

cpe:2.3:a:typelevel:http4s:0.15.5
Typelevel » Http4s » Version: 0.15.6

cpe:2.3:a:typelevel:http4s:0.15.6
Typelevel » Http4s » Version: 0.15.7

cpe:2.3:a:typelevel:http4s:0.15.7
Typelevel » Http4s » Version: 0.15.8

cpe:2.3:a:typelevel:http4s:0.15.8
Typelevel » Http4s » Version: 0.15.9

cpe:2.3:a:typelevel:http4s:0.15.9
Typelevel » Http4s » Version: 0.16.0

cpe:2.3:a:typelevel:http4s:0.16.0
Typelevel » Http4s » Version: 0.16.1

cpe:2.3:a:typelevel:http4s:0.16.1
Typelevel » Http4s » Version: 0.16.2

cpe:2.3:a:typelevel:http4s:0.16.2
Typelevel » Http4s » Version: 0.16.3

cpe:2.3:a:typelevel:http4s:0.16.3
Typelevel » Http4s » Version: 0.16.4

cpe:2.3:a:typelevel:http4s:0.16.4
Typelevel » Http4s » Version: 0.16.5

cpe:2.3:a:typelevel:http4s:0.16.5
Typelevel » Http4s » Version: 0.16.6

cpe:2.3:a:typelevel:http4s:0.16.6
Typelevel » Http4s » Version: 0.17.0

cpe:2.3:a:typelevel:http4s:0.17.0
Typelevel » Http4s » Version: 0.17.1

cpe:2.3:a:typelevel:http4s:0.17.1
Typelevel » Http4s » Version: 0.17.2

cpe:2.3:a:typelevel:http4s:0.17.2
Typelevel » Http4s » Version: 0.17.3

cpe:2.3:a:typelevel:http4s:0.17.3
Typelevel » Http4s » Version: 0.17.4

cpe:2.3:a:typelevel:http4s:0.17.4
Typelevel » Http4s » Version: 0.17.5

cpe:2.3:a:typelevel:http4s:0.17.5
Typelevel » Http4s » Version: 0.17.6

cpe:2.3:a:typelevel:http4s:0.17.6
Typelevel » Http4s » Version: 0.18.0

cpe:2.3:a:typelevel:http4s:0.18.0
Typelevel » Http4s » Version: 0.18.1

cpe:2.3:a:typelevel:http4s:0.18.1
Typelevel » Http4s » Version: 0.18.10

cpe:2.3:a:typelevel:http4s:0.18.10
Typelevel » Http4s » Version: 0.18.11

cpe:2.3:a:typelevel:http4s:0.18.11
Typelevel » Http4s » Version: 0.18.12

cpe:2.3:a:typelevel:http4s:0.18.12
Typelevel » Http4s » Version: 0.18.13

cpe:2.3:a:typelevel:http4s:0.18.13
Typelevel » Http4s » Version: 0.18.14

cpe:2.3:a:typelevel:http4s:0.18.14
Typelevel » Http4s » Version: 0.18.15

cpe:2.3:a:typelevel:http4s:0.18.15
Typelevel » Http4s » Version: 0.18.16

cpe:2.3:a:typelevel:http4s:0.18.16
Typelevel » Http4s » Version: 0.18.17

cpe:2.3:a:typelevel:http4s:0.18.17
Typelevel » Http4s » Version: 0.18.18

cpe:2.3:a:typelevel:http4s:0.18.18
Typelevel » Http4s » Version: 0.18.19

cpe:2.3:a:typelevel:http4s:0.18.19
Typelevel » Http4s » Version: 0.18.2

cpe:2.3:a:typelevel:http4s:0.18.2
Typelevel » Http4s » Version: 0.18.20

cpe:2.3:a:typelevel:http4s:0.18.20
Typelevel » Http4s » Version: 0.18.21

cpe:2.3:a:typelevel:http4s:0.18.21
Typelevel » Http4s » Version: 0.18.22

cpe:2.3:a:typelevel:http4s:0.18.22
Typelevel » Http4s » Version: 0.18.23

cpe:2.3:a:typelevel:http4s:0.18.23
Typelevel » Http4s » Version: 0.18.24

cpe:2.3:a:typelevel:http4s:0.18.24
Typelevel » Http4s » Version: 0.18.25

cpe:2.3:a:typelevel:http4s:0.18.25
Typelevel » Http4s » Version: 0.18.26

cpe:2.3:a:typelevel:http4s:0.18.26
Typelevel » Http4s » Version: 0.18.3

cpe:2.3:a:typelevel:http4s:0.18.3
Typelevel » Http4s » Version: 0.18.4

cpe:2.3:a:typelevel:http4s:0.18.4
Typelevel » Http4s » Version: 0.18.5

cpe:2.3:a:typelevel:http4s:0.18.5
Typelevel » Http4s » Version: 0.18.6

cpe:2.3:a:typelevel:http4s:0.18.6
Typelevel » Http4s » Version: 0.18.7

cpe:2.3:a:typelevel:http4s:0.18.7
Typelevel » Http4s » Version: 0.18.8

cpe:2.3:a:typelevel:http4s:0.18.8
Typelevel » Http4s » Version: 0.18.9

cpe:2.3:a:typelevel:http4s:0.18.9
Typelevel » Http4s » Version: 0.19.0

cpe:2.3:a:typelevel:http4s:0.19.0
Typelevel » Http4s » Version: 0.2.0

cpe:2.3:a:typelevel:http4s:0.2.0
Typelevel » Http4s » Version: 0.20.0

cpe:2.3:a:typelevel:http4s:0.20.0
Typelevel » Http4s » Version: 0.20.1

cpe:2.3:a:typelevel:http4s:0.20.1
Typelevel » Http4s » Version: 0.20.10

cpe:2.3:a:typelevel:http4s:0.20.10
Typelevel » Http4s » Version: 0.20.11

cpe:2.3:a:typelevel:http4s:0.20.11
Typelevel » Http4s » Version: 0.20.12

cpe:2.3:a:typelevel:http4s:0.20.12
Typelevel » Http4s » Version: 0.20.13

cpe:2.3:a:typelevel:http4s:0.20.13
Typelevel » Http4s » Version: 0.20.14

cpe:2.3:a:typelevel:http4s:0.20.14
Typelevel » Http4s » Version: 0.20.15

cpe:2.3:a:typelevel:http4s:0.20.15
Typelevel » Http4s » Version: 0.20.16

cpe:2.3:a:typelevel:http4s:0.20.16
Typelevel » Http4s » Version: 0.20.17

cpe:2.3:a:typelevel:http4s:0.20.17
Typelevel » Http4s » Version: 0.20.18

cpe:2.3:a:typelevel:http4s:0.20.18
Typelevel » Http4s » Version: 0.20.19

cpe:2.3:a:typelevel:http4s:0.20.19
Typelevel » Http4s » Version: 0.20.2

cpe:2.3:a:typelevel:http4s:0.20.2
Typelevel » Http4s » Version: 0.20.20

cpe:2.3:a:typelevel:http4s:0.20.20
Typelevel » Http4s » Version: 0.20.21

cpe:2.3:a:typelevel:http4s:0.20.21
Typelevel » Http4s » Version: 0.20.22

cpe:2.3:a:typelevel:http4s:0.20.22
Typelevel » Http4s » Version: 0.20.23

cpe:2.3:a:typelevel:http4s:0.20.23
Typelevel » Http4s » Version: 0.20.3

cpe:2.3:a:typelevel:http4s:0.20.3
Typelevel » Http4s » Version: 0.20.4

cpe:2.3:a:typelevel:http4s:0.20.4
Typelevel » Http4s » Version: 0.20.6

cpe:2.3:a:typelevel:http4s:0.20.6
Typelevel » Http4s » Version: 0.20.7

cpe:2.3:a:typelevel:http4s:0.20.7
Typelevel » Http4s » Version: 0.20.8

cpe:2.3:a:typelevel:http4s:0.20.8
Typelevel » Http4s » Version: 0.20.9

cpe:2.3:a:typelevel:http4s:0.20.9
Typelevel » Http4s » Version: 0.21.0

cpe:2.3:a:typelevel:http4s:0.21.0
Typelevel » Http4s » Version: 0.21.1

cpe:2.3:a:typelevel:http4s:0.21.1
Typelevel » Http4s » Version: 0.21.11

cpe:2.3:a:typelevel:http4s:0.21.11
Typelevel » Http4s » Version: 0.21.12

cpe:2.3:a:typelevel:http4s:0.21.12
Typelevel » Http4s » Version: 0.21.13

cpe:2.3:a:typelevel:http4s:0.21.13
Typelevel » Http4s » Version: 0.21.14

cpe:2.3:a:typelevel:http4s:0.21.14
Typelevel » Http4s » Version: 0.21.15

cpe:2.3:a:typelevel:http4s:0.21.15
Typelevel » Http4s » Version: 0.21.16

cpe:2.3:a:typelevel:http4s:0.21.16
Typelevel » Http4s » Version: 0.21.17

cpe:2.3:a:typelevel:http4s:0.21.17
Typelevel » Http4s » Version: 0.21.18

cpe:2.3:a:typelevel:http4s:0.21.18
Typelevel » Http4s » Version: 0.21.19

cpe:2.3:a:typelevel:http4s:0.21.19
Typelevel » Http4s » Version: 0.21.2

cpe:2.3:a:typelevel:http4s:0.21.2
Typelevel » Http4s » Version: 0.21.20

cpe:2.3:a:typelevel:http4s:0.21.20
Typelevel » Http4s » Version: 0.21.21

cpe:2.3:a:typelevel:http4s:0.21.21
Typelevel » Http4s » Version: 0.21.22

cpe:2.3:a:typelevel:http4s:0.21.22
Typelevel » Http4s » Version: 0.21.23

cpe:2.3:a:typelevel:http4s:0.21.23
Typelevel » Http4s » Version: 0.21.24

cpe:2.3:a:typelevel:http4s:0.21.24
Typelevel » Http4s » Version: 0.21.28

cpe:2.3:a:typelevel:http4s:0.21.28
Typelevel » Http4s » Version: 0.21.3

cpe:2.3:a:typelevel:http4s:0.21.3
Typelevel » Http4s » Version: 0.21.4

cpe:2.3:a:typelevel:http4s:0.21.4
Typelevel » Http4s » Version: 0.21.5

cpe:2.3:a:typelevel:http4s:0.21.5
Typelevel » Http4s » Version: 0.21.6

cpe:2.3:a:typelevel:http4s:0.21.6
Typelevel » Http4s » Version: 0.21.7

cpe:2.3:a:typelevel:http4s:0.21.7
Typelevel » Http4s » Version: 0.21.8

cpe:2.3:a:typelevel:http4s:0.21.8
Typelevel » Http4s » Version: 0.21.9

cpe:2.3:a:typelevel:http4s:0.21.9
Typelevel » Http4s » Version: 0.22.0

cpe:2.3:a:typelevel:http4s:0.22.0
Typelevel » Http4s » Version: 0.22.1

cpe:2.3:a:typelevel:http4s:0.22.1
Typelevel » Http4s » Version: 0.22.2

cpe:2.3:a:typelevel:http4s:0.22.2
Typelevel » Http4s » Version: 0.22.3

cpe:2.3:a:typelevel:http4s:0.22.3
Typelevel » Http4s » Version: 0.22.4

cpe:2.3:a:typelevel:http4s:0.22.4
Typelevel » Http4s » Version: 0.23.0

cpe:2.3:a:typelevel:http4s:0.23.0
Typelevel » Http4s » Version: 0.23.1

cpe:2.3:a:typelevel:http4s:0.23.1
Typelevel » Http4s » Version: 0.23.2

cpe:2.3:a:typelevel:http4s:0.23.2
Typelevel » Http4s » Version: 0.23.3

cpe:2.3:a:typelevel:http4s:0.23.3
Typelevel » Http4s » Version: 0.3.0

cpe:2.3:a:typelevel:http4s:0.3.0
Typelevel » Http4s » Version: 0.4.0

cpe:2.3:a:typelevel:http4s:0.4.0
Typelevel » Http4s » Version: 0.4.1

cpe:2.3:a:typelevel:http4s:0.4.1
Typelevel » Http4s » Version: 0.4.2

cpe:2.3:a:typelevel:http4s:0.4.2
Typelevel » Http4s » Version: 0.5.0

cpe:2.3:a:typelevel:http4s:0.5.0
Typelevel » Http4s » Version: 0.5.1

cpe:2.3:a:typelevel:http4s:0.5.1
Typelevel » Http4s » Version: 0.5.2

cpe:2.3:a:typelevel:http4s:0.5.2
Typelevel » Http4s » Version: 0.5.3

cpe:2.3:a:typelevel:http4s:0.5.3
Typelevel » Http4s » Version: 0.5.4

cpe:2.3:a:typelevel:http4s:0.5.4
Typelevel » Http4s » Version: 0.6.0

cpe:2.3:a:typelevel:http4s:0.6.0
Typelevel » Http4s » Version: 0.6.1

cpe:2.3:a:typelevel:http4s:0.6.1
Typelevel » Http4s » Version: 0.6.2

cpe:2.3:a:typelevel:http4s:0.6.2
Typelevel » Http4s » Version: 0.6.3

cpe:2.3:a:typelevel:http4s:0.6.3
Typelevel » Http4s » Version: 0.6.4

cpe:2.3:a:typelevel:http4s:0.6.4
Typelevel » Http4s » Version: 0.6.5

cpe:2.3:a:typelevel:http4s:0.6.5
Typelevel » Http4s » Version: 0.7.0

cpe:2.3:a:typelevel:http4s:0.7.0
Typelevel » Http4s » Version: 0.8.0

cpe:2.3:a:typelevel:http4s:0.8.0
Typelevel » Http4s » Version: 0.8.1

cpe:2.3:a:typelevel:http4s:0.8.1
Typelevel » Http4s » Version: 0.8.2

cpe:2.3:a:typelevel:http4s:0.8.2
Typelevel » Http4s » Version: 0.8.3

cpe:2.3:a:typelevel:http4s:0.8.3
Typelevel » Http4s » Version: 0.8.4

cpe:2.3:a:typelevel:http4s:0.8.4
Typelevel » Http4s » Version: 0.8.5

cpe:2.3:a:typelevel:http4s:0.8.5
Typelevel » Http4s » Version: 0.8.6

cpe:2.3:a:typelevel:http4s:0.8.6
Typelevel » Http4s » Version: 0.9.0

cpe:2.3:a:typelevel:http4s:0.9.0
Typelevel » Http4s » Version: 0.9.1

cpe:2.3:a:typelevel:http4s:0.9.1
Typelevel » Http4s » Version: 0.9.2

cpe:2.3:a:typelevel:http4s:0.9.2
Typelevel » Http4s » Version: 0.9.3

cpe:2.3:a:typelevel:http4s:0.9.3
Typelevel » Http4s » Version: 1.0.0

cpe:2.3:a:typelevel:http4s:1.0.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-41084

Products

Pricing

Contact Us