CVE-2021-41084

Katalog CVE

CVSS 4.7 · Medium EPSS 1,2%

Kerentanan Server-Side Request Forgery (SSRF) pada typelevel http4s. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

Rincian

Terbit di NVD

21 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values advisory vendor
• https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8 patch · advisory pihak ketiga
• https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3 exploit · advisory pihak ketiga
• https://owasp.org/www-community/attacks/HTTP_Response_Splitting advisory pihak ketiga