CVE-2021-41084: Server-Side Request Forgery (SSRF)

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå, Header values Header.value, Status reason phrases...

org.http4s:http4s-blaze-server_2.11 (0.12.1), org.http4s:http4s-jetty_2.11 (0.12.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.1)

org.http4s:http4s-server2.11 MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.1 - org.http4s:http4s-jetty2.11 0.12.1 -...

org.http4s:http4s-blaze-server_2.10 (0.12.2), org.http4s:http4s-jetty_2.10 (0.12.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.12.2)

org.http4s:http4s-server2.10 MAVEN version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.12.2 - org.http4s:http4s-jetty2.10 0.12.2 -...

org.http4s:http4s-blazeserver_2.10 (0.8.4), org.http4s:http4s-jetty_2.10 (0.8.4) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.8.4)

org.http4s:http4s-server2.10 MAVEN version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.8.4 - org.http4s:http4s-jetty2.10 0.8.4 -...

com.github.fomkin:korolev-example_2.11 (0.0.3-pre), com.github.fomkin:korolev-server_2.11 (>=0.0.1-pre, <=0.0.3-pre) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.14.4)

org.http4s:http4s-server2.11 MAVEN version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.github.fomkin:korolev-example2.11 0.0.3-pre - com.github.fomkin:korolev-server2.11 =0.0.1-pre,...

org.http4s:http4s-blaze-server_2.10 (0.15.14a), org.http4s:http4s-jetty_2.10 (0.15.14a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.15.14a)

org.http4s:http4s-server2.10 MAVEN version 0.15.14a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.15.14a - org.http4s:http4s-jetty2.10 0.15.14a -...

org.http4s:http4s-blaze-server_2.10 (0.12.1), org.http4s:http4s-jetty_2.10 (0.12.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.12.1)

org.http4s:http4s-server2.10 MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.12.1 - org.http4s:http4s-jetty2.10 0.12.1 -...

org.http4s:http4s-blaze-server_2.10 (0.13.1a), org.http4s:http4s-jetty_2.10 (0.13.1a) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.13.1a)

org.http4s:http4s-server2.10 MAVEN version 0.13.1a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.13.1a - org.http4s:http4s-jetty2.10 0.13.1a -...

org.http4s:http4s-blaze-server_2.11 (0.15.15), org.http4s:http4s-jetty_2.11 (0.15.15) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.15)

org.http4s:http4s-server2.11 MAVEN version 0.15.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.15 - org.http4s:http4s-jetty2.11 0.15.15 -...

org.http4s:http4s-blaze-server_2.11 (0.13.0a), org.http4s:http4s-jetty_2.11 (0.13.0a) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.13.0a)

org.http4s:http4s-server2.11 MAVEN version 0.13.0a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.13.0a - org.http4s:http4s-jetty2.11 0.13.0a -...

com.itv:scalapact-core_2.10 (>=2.1.0, <=2.2.1), com.itv:scalapact-http4s-0-15-0a_2.10 (>=2.2.0, <=2.2.1) +5 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.15.0a)

org.http4s:http4s-server2.10 MAVEN version 0.15.0a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - com.itv:scalapact-core2.10 =2.1.0, =2.2.0, =2.2.1 - org.http4s:http4s-blaze-server2.10 0.15.0a -...

org.http4s:http4s-blaze-server_2.10 (0.14.3a), org.http4s:http4s-jetty_2.10 (0.14.3a) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.14.3a)

org.http4s:http4s-server2.10 MAVEN version 0.14.3a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.14.3a - org.http4s:http4s-jetty2.10 0.14.3a -...

org.http4s:http4s-blaze-server_2.10 (0.15.15), org.http4s:http4s-jetty_2.10 (0.15.15) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.15.15)

org.http4s:http4s-server2.10 MAVEN version 0.15.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.15.15 - org.http4s:http4s-jetty2.10 0.15.15 -...

org.http4s:http4s-blaze-server_2.11 (0.12.5), org.http4s:http4s-jetty_2.11 (0.12.5) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.5)

org.http4s:http4s-server2.11 MAVEN version 0.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.5 - org.http4s:http4s-jetty2.11 0.12.5 -...

org.http4s:http4s-blaze-server_2.11 (0.20.2), org.http4s:http4s-jetty_2.11 (0.20.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.2)

org.http4s:http4s-server2.11 MAVEN version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.2 - org.http4s:http4s-jetty2.11 0.20.2 -...

org.http4s:http4s-blaze-server_2.11 (0.16.0-rc3), org.http4s:http4s-jetty_2.11 (0.16.0-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.16.0-rc3)

org.http4s:http4s-server2.11 MAVEN version 0.16.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.16.0-rc3 - org.http4s:http4s-jetty2.11 0.16.0-rc3 -...

org.http4s:http4s-blaze-server_2.11 (0.12.6), org.http4s:http4s-jetty_2.11 (0.12.6) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.6)

org.http4s:http4s-server2.11 MAVEN version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.6 - org.http4s:http4s-jetty2.11 0.12.6 -...

com.groupon.sparklint:sparklint-spark160_2.11 (1.0.4), com.groupon.sparklint:sparklint-spark161_2.11 (1.0.4) +10 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.13.2)

org.http4s:http4s-server2.11 MAVEN version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.groupon.sparklint:sparklint-spark1602.11 1.0.4 - com.groupon.sparklint:sparklint-spark1612.11 1.0....

org.http4s:http4s-blaze-server_2.10 (0.15.2), org.http4s:http4s-jetty_2.10 (0.15.2) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.15.2)

org.http4s:http4s-server2.10 MAVEN version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.15.2 - org.http4s:http4s-jetty2.10 0.15.2 -...

org.http4s:http4s-blaze-server_2.10 (0.10.1), org.http4s:http4s-jetty_2.10 (0.10.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.10.1)

org.http4s:http4s-server2.10 MAVEN version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.10.1 - org.http4s:http4s-jetty2.10 0.10.1 -...