High severity8.7NVD Advisory· Published Sep 21, 2021· Updated Jun 17, 2026
CVE-2021-41084
CVE-2021-41084
Description
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (Header.nameå), Header values (Header.value), Status reason phrases (Status.reason), URI paths (Uri.Path), URI authority registered names (URI.RegName) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.http4s:http4s-client_2.12Maven | < 0.21.29 | 0.21.29 |
org.http4s:http4s-client_2.12Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-client_2.12Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
org.http4s:http4s-client_2.13Maven | < 0.21.29 | 0.21.29 |
org.http4s:http4s-client_2.13Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-client_2.13Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
org.http4s:http4s-client_3Maven | < 0.21.29 | 0.21.29 |
org.http4s:http4s-client_3Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-client_3Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
org.http4s:http4s-server_2.10Maven | <= 0.21.28 | — |
org.http4s:http4s-server_2.11Maven | <= 0.21.28 | — |
org.http4s:http4s-server_2.12Maven | < 0.21.29 | 0.21.29 |
org.http4s:http4s-server_2.12Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-server_2.12Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
org.http4s:http4s-server_2.13Maven | < 0.21.29 | 0.21.29 |
org.http4s:http4s-server_2.13Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-server_2.13Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
org.http4s:http4s-server_2.13.0-M5Maven | <= 0.21.28 | — |
org.http4s:http4s-server_3Maven | >= 0.22.0, < 0.22.5 | 0.22.5 |
org.http4s:http4s-server_3Maven | >= 0.23.0, < 0.23.4 | 0.23.4 |
Affected products
37- http4s/http4sv5Range: <= 0.21.28
- ghsa-coords9 versionspkg:maven/org.http4s/http4s-client_2.12pkg:maven/org.http4s/http4s-client_2.13pkg:maven/org.http4s/http4s-client_3pkg:maven/org.http4s/http4s-server_2.10pkg:maven/org.http4s/http4s-server_2.11pkg:maven/org.http4s/http4s-server_2.12pkg:maven/org.http4s/http4s-server_2.13pkg:maven/org.http4s/http4s-server_2.13.0-M5pkg:maven/org.http4s/http4s-server_3
< 0.21.29+ 8 more
- (no CPE)range: < 0.21.29
- (no CPE)range: < 0.21.29
- (no CPE)range: < 0.21.29
- (no CPE)range: <= 0.21.28
- (no CPE)range: <= 0.21.28
- (no CPE)range: < 0.21.29
- (no CPE)range: < 0.21.29
- (no CPE)range: <= 0.21.28
- (no CPE)range: >= 0.22.0, < 0.22.5
cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*+ 26 more
- cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*range: <0.21.29
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
6- github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8nvdPatchThird Party AdvisoryWEB
- github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-5vcm-3xc3-w7x3ghsaADVISORY
- httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.htmlnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-41084ghsaADVISORY
- owasp.org/www-community/attacks/HTTP_Response_SplittingnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.