VYPR
← All advisories
High severity7.5NVD Advisory· Published Jan 4, 2023· Updated Jun 17, 2026

CVE-2023-22465

CVE-2023-22465

Description

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.http4s:http4s-core_2.13Maven
>= 0.1.0, < 0.21.340.21.34
org.http4s:http4s-core_2.13Maven
>= 0.22.0, < 0.22.150.22.15
org.http4s:http4s-core_2.13Maven
>= 0.23.0, < 0.23.170.23.17
org.http4s:http4s-core_2.13Maven
>= 1.0.0-M1, < 1.0.0-M381.0.0-M38
org.http4s:http4s-core_2.10Maven
>= 0.1.0, <= 0.9.3—
org.http4s:http4s-core_2.11Maven
>= 0.1.0, <= 0.21.0-M1—
org.http4s:http4s-core_2.12Maven
>= 0.1.0, < 0.21.340.21.34
org.http4s:http4s-core_2.12Maven
>= 0.22.0, < 0.22.150.22.15
org.http4s:http4s-core_2.12Maven
>= 0.23.0, < 0.23.170.23.17
org.http4s:http4s-coreMaven
>= 1.0.0-M1, <= 1.0.0-M30—

Affected products

44
  • http4s/http4sv5
    Range: >= 0.1.0, < 0.21.34
  • ghsa-coords5 versions
    pkg:maven/org.http4s/http4s-core_2.13pkg:maven/org.http4s/http4s-core_2.10pkg:maven/org.http4s/http4s-core_2.11pkg:maven/org.http4s/http4s-core_2.12pkg:maven/org.http4s/http4s-core
    >= 0.1.0, < 0.21.34+ 4 more
    • (no CPE)range: >= 0.1.0, < 0.21.34
    • (no CPE)range: >= 0.1.0, <= 0.9.3
    • (no CPE)range: >= 0.1.0, <= 0.21.0-M1
    • (no CPE)range: >= 0.1.0, < 0.21.34
    • (no CPE)range: >= 1.0.0-M1, <= 1.0.0-M30
  • Typelevel/Http4s38 versions
    cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*+ 37 more
    • cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*range: >=0.1.0,<0.21.34
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*
    • cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.