ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.akolov:doorman-core_2.12 (0.0.5) +116 more potentially affected by CVE-2021-21294 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=0.21.16)

org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.13, =0.1.0.1 and more Source cves: CVE-2021-21294 Source advisory: MEND:CVE-2021-21294...

CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-21293 Unbounded connection acceptance leads to file handle exhaustion

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-21294: Uncontrolled Resource Consumption

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

PT-2021-14396 · Unknown +2 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: http4s versions prior to 0.21.17 http4s versions prior to 0.22.0-M2 http4s versions prior to 1.0.0-M14 Description: The issue is related to the blaze-core library, which accepts connections unboundedly on its selector pool. This can lead to a...

CVE-2021-21293: Uncontrolled Resource Consumption

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Http4s Blaze Resource Management Error Vulnerability

Http4s Blaze is a java-based NIO codebase for processing network streams from the Http4s organization. A security vulnerability exists in Http4s Blaze that originates from accepting connections without restriction on a selector pool. The following products and versions are affected: Http4s before...

PT-2021-14395 · Unknown +1 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: blaze-core versions prior to 0.14.15 http4s-blaze-server versions prior to 0.21.17 Description: The issue is caused by unbounded connection acceptance in blaze-core, leading to file handle exhaustion. This can amplify degradation in services...

Http4s Blaze Resource Management Error Vulnerability

Http4s Blaze is a java-based NIO codebase for processing network streams from the Http4s organization. A resource management error vulnerability exists in Http4s Blaze that stems from the fact that unlimited connection acceptance will result in file handle exhaustion...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

GHSA-8HXH-R6F7-JF45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

Design/Logic Flaw

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

CVE-2020-5280

CVE-2020-5280 affects http4s prior to versions 0.18.26, 0.20.20, and 0.21.2. The local file inclusion arises from incorrect URI normalization in FileService, ResourceService, and WebjarService, allowing path segments like ../ or // to access resources outside the configured location. Patches exis...