Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

Response Splitting from unsanitized headers

Impact http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå Header values Header.value Status reason phrases Status.reason URI paths Uri.Path URI authority registered names...

com.banno:vault4s_3 (8.0.0), io.chrisdavenport:github_3 (0.2.0) +6 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client3 MAVEN version =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.47deg:github4s_3 (>=0.29.1, <=0.30.0), com.banno:vault4s_3 (9.0.0) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client3 MAVEN version =0.23.0, =0.29.1, =0.8.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.9.0-m5, =3.3.13, =0.18.3, =0.1.0, =0.1.0, =0.3.2 - io.janstenpickle:trace4cats-datadog-http-exporter3 0.12.0 - io.janstenpickle:trace4cats-exporter-http3 0.12.0 and more Source cves: CVE-2021-4108...

com.47deg:github4s_3 (>=0.29.1, <=0.30.0), com.banno:vault4s_3 (9.0.0) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client3 MAVEN version =0.23.0, =0.29.1, =0.8.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.9.0-m5, =3.3.13, =0.18.3, =0.1.0, =0.1.0, =0.3.2 - io.janstenpickle:trace4cats-datadog-http-exporter3 0.12.0 - io.janstenpickle:trace4cats-exporter-http3 0.12.0 and more Source cves: CVE-2021-4108...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), com.47deg:github4s_2.13 (>=0.22.0, <=0.28.5) +169 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-client2.13 MAVEN version =0.10.0-m10, =1.5.0-rc4, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =6.0.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.13 (0.8.0), com.alejandrohdezma:http4s-munit_2.13 (0.8.0) +31 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.13 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =0.0.10, =0.1.2 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.13 (0.8.0), com.alejandrohdezma:http4s-munit_2.13 (0.8.0) +31 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.13 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =0.0.10, =0.1.2 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.47deg:github4s_2.13 (>=0.29.1, <=0.30.0), com.banno:vault4s_2.13 (9.0.0) +44 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client2.13 MAVEN version =0.23.0, =0.29.1, =0.7.0, =1.2.2, =3.3.2, =3.3.2, =0.9.0-m5, =0.18.0-rc1, =3.3.13, =0.18.3, =0.3.0, =0.3.1 - io.chrisdavenport:mules-http4s2.13 0.3.0-m1 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.gaborpihaj:http4s-jwt-auth-middleware_2.11 (0.1.0), com.github.agourlay:cornichon-http-mock_2.11 (>=0.12.7, <=0.16.1) +65 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.11 (>=0.2.0, <=0.21.0-m1)

org.http4s:http4s-server2.11 MAVEN version =0.2.0, =0.12.7, =0.0.3, =0.0.3-pre, =0.0.1-pre, =1.1.0, =0.1, =0.1.0-rc2, =1.0.4, =1.0.12 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.4) +4 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.4) +4 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_3 (1.1.1), com.itv:scalapact-http4s-0-23_3 (>=4.0.0-rc1, <=4.2.0) +13 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server3 MAVEN version =0.23.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.19.0-m4, =0.19.0-m4, =0.12.0-rc2+5-dd85de58, =0.12.0-rc2+5-dd85de58, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.3 - org.planet42:laika-preview3 0.18.0 Source cves: CVE-2021-41084 Source advisory:...

com.47deg:embedded-cassandra-core_2.12 (0.0.7), com.47deg:github4s_2.12 (>=0.22.0, <=0.28.5) +206 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-client2.12 MAVEN version =0.10.0-m10, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.11, =0.11.3 - com.azavea.geotrellis:geotrellis-server-stac-example2.12 4.4.0 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.12 (0.8.0), com.alejandrohdezma:http4s-munit_2.12 (0.8.0) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.12 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =3.17.8.2, =3.17.42.2 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.12 (0.8.0), com.alejandrohdezma:http4s-munit_2.12 (0.8.0) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.12 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =3.17.8.2, =3.17.42.2 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.akolov:doorman-core_2.12 (0.0.5) +166 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-server2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.6 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.avast.grpc:grpc-json-bridge-http4s_2.12 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.12.0, <=0.12.2) +26 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server2.12 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =0.18.1, =0.18.1, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_2.12 (1.1.1), com.iheart:thomas-http4s_2.12 (>=1.2.0, <=1.3.9) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.12.0-rc2+5-dd85de58, =0.12.0 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_2.12 (1.1.1), com.iheart:thomas-http4s_2.12 (>=1.2.0, <=1.3.9) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.12.0-rc2+5-dd85de58, =0.12.0 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...