Design/Logic Flaw

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...

CVE-2021-32643 StaticFile.fromUrl can leak presence of a directory

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...

CVE-2021-32643

The CVE-2021-32643 issue affects http4s (Scala HTTP services) where StaticFile.fromUrl can reveal the existence of a server directory when the URL scheme is not file://. If url.getFile is a directory, a non-file URL could yield a 404 that leaks directory presence, without exposing contents or met...

http4s 路径遍历漏洞

Http4s is an open source for Scala streaming HTTP server . Http4s has a path traversal vulnerability that can be exploited by an attacker to obtain sensitive information...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

Design/Logic Flaw

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

Unbounded connection acceptance in http4s-blaze-server

Impact blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an...

com.akolov:doorman_2.13 (>=0.2.0 <=0.4.0), com.avast.grpc:grpc-json-bridge-http4s_2.13 (>=0.18.3 <=0.18.4) +56 more potentially affected by CVE-2021-21293 +1 more via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-M1 <=0.21.16)

org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-M1, =0.2.0, =0.18.3, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-M1, =0.0.7-M1, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.42 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory: OSV:GHSA-XHV5-W9C5-2...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0 <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (=0.0.7) +146 more potentially affected by CVE-2021-21293 +1 more via org.http4s:blaze-core_2.12 (>=0.12.4 <=0.14.14)

org.http4s:blaze-core2.12 MAVEN version =0.12.4, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.18.1, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.5.6 - com.azavea.geotrellis:geotrellis-stac-example2.12 =4.3.0 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory:...

Unbounded connection acceptance leads to file handle exhaustion

Impact All servers running blaze-core = 0.14.14, including blaze-http and http4s-blaze-server users, are affected. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request...

GHSA-XMW9-Q7X9-J5QC Unbounded connection acceptance leads to file handle exhaustion

Impact All servers running blaze-core = 0.14.14, including blaze-http and http4s-blaze-server users, are affected. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request...

CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21294

The CVE-2021-21294 issue affects http4s-blaze-server (BlazeCore) where the server accepts connections unboundedly on its selector pool, potentially exhausting OS resources and undermining circuit breakers. Affected: http4s-blaze-server variants prior to 0.21.17, 0.22.0-M2, and 1.0.0-M14; underlyi...

CVE-2021-21293 Unbounded connection acceptance leads to file handle exhaustion

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

PT-2021-14395 · Unknown +1 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: blaze-core versions prior to 0.14.15 http4s-blaze-server versions prior to 0.21.17 Description: The issue is caused by unbounded connection acceptance in blaze-core, leading to file handle exhaustion. This can amplify degradation in services...

PT-2021-14396 · Unknown +2 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: http4s versions prior to 0.21.17 http4s versions prior to 0.22.0-M2 http4s versions prior to 1.0.0-M14 Description: The issue is related to the blaze-core library, which accepts connections unboundedly on its selector pool. This can lead to a...

Http4s Blaze Resource Management Error Vulnerability

Http4s Blaze is a java-based NIO codebase for processing network streams from the Http4s organization. A security vulnerability exists in Http4s Blaze that originates from accepting connections without restriction on a selector pool. The following products and versions are affected: Http4s before...

Http4s Blaze Resource Management Error Vulnerability

Http4s Blaze is a java-based NIO codebase for processing network streams from the Http4s organization. A resource management error vulnerability exists in Http4s Blaze that stems from the fact that unlimited connection acceptance will result in file handle exhaustion...