com.banno:vault4s_3 (8.0.0), io.chrisdavenport:github_3 (0.2.0) +6 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client3 MAVEN version =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.4) +4 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.12 (0.8.0), com.alejandrohdezma:http4s-munit_2.12 (0.8.0) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.12 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =3.17.8.2, =3.17.42.2 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_2.12 (1.1.1), com.iheart:thomas-http4s_2.12 (>=1.2.0, <=1.3.9) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.12.0-rc2+5-dd85de58, =0.12.0 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.6.0), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +135 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.13 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-server2.13 MAVEN version =0.10.0-m10, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m1, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.13 (0.8.0), com.alejandrohdezma:http4s-munit_2.13 (0.8.0) +31 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.13 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =0.0.10, =0.1.2 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

Response Splitting

http4s-client is vulnerable to response splitting. Creating the fields such as Header names Header.name, Header values Header.value, Status reason phrases Status.reason, URI paths Uri.Path, URI authority registered names URI.RegName allows an attacker to inject a malicious character such as...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

Design/Logic Flaw

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

com.47deg:github4s_3 (>=0.29.1, <=0.30.0), com.banno:vault4s_3 (9.0.0) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client3 MAVEN version =0.23.0, =0.29.1, =0.8.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.9.0-m5, =3.3.13, =0.18.3, =0.1.0, =0.1.0, =0.3.2 - io.janstenpickle:trace4cats-datadog-http-exporter3 0.12.0 - io.janstenpickle:trace4cats-exporter-http3 0.12.0 and more Source cves: CVE-2021-4108...

com.avast.grpc:grpc-json-bridge-http4s_2.12 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.12.0, <=0.12.2) +26 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server2.12 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =0.18.1, =0.18.1, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-41084 Source advisory: MEND:CVE-2021-41084...

com.busymachines:pureharm-route-http4s-tapir_2.13 (>=0.5.0-m2, <=0.5-11-334582e), com.github.ghostdogpr:caliban-http4s_2.13 (1.1.1) +33 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.13 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.13 MAVEN version =0.23.0, =0.5.0-m2, =1.2.2, =1.2.2, =1.2.2, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.2.0 - dev.profunktor:http4s-jwt-auth2.13 1.0.0 - io.chrisdavenport:mules-http4s2.13 0.3.0-m1 - io.github.apimorphism:telegramium-high2.13 7.53.0 -...

CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), com.47deg:github4s_2.13 (>=0.22.0, <=0.28.5) +169 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-client2.13 MAVEN version =0.10.0-m10, =1.5.0-rc4, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =6.0.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2021-41084 Source advisory: MEND:CVE-2021-41084...

CVE-2021-41084 Response Splitting from unsanitized headers in http4s

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

CVE-2021-41084

The CVE-2021-41084 issue affects http4s, where untrusted input in header names, header values, status reason phrases, URI paths, or URI registered names can enable response-splitting or request-splitting attacks. The vulnerability spans affected http4s versions up to 0.21.x and is fixed in 0.21.3...

com.github.ghostdogpr:caliban-http4s_2.12 (1.1.1), com.iheart:thomas-http4s_2.12 (>=1.2.0, <=1.3.9) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.12.0-rc2+5-dd85de58, =0.12.0 and more Source cves: CVE-2021-41084 Source advisory: MEND:CVE-2021-41084...

http4s injection vulnerability

http4s is an open source streaming HTTP server for Scala. http4s suffers from an injection vulnerability that arises from improper design or implementation during code development of a network system or product...