{"id":"CVE-2021-32643","details":"Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.","aliases":["GHSA-6h7w-fc84-x7p6"],"modified":"2026-07-09T12:20:02.685760Z","published":"2021-05-27T18:15:07.903Z","references":[{"type":"ADVISORY","url":"https://mvnrepository.com/artifact/org.http4s/http4s-core"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9"},{"type":"FIX","url":"https://github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/http4s/http4s","events":[{"introduced":"6ad94f6ffeda3644321d85fcaf82d666d996e87a"},{"fixed":"2d2e26171bfc2881ea4b00c42c463d801c777db0"},{"introduced":"c56f915bd81c2fe19dcb04e32ad39c3972fac2e1"},{"last_affected":"6676c1e24a4e32e0c6c1a36911f4e6606c10e12b"},{"fixed":"52e1890665410b4385e37b96bc49c5e3c708e4e9"}],"database_specific":{"cpe":["cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.22.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:0.23.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.21.7"},{"fixed":"0.21.24"},{"introduced":"0.22.0-milestone1"},{"last_affected":"0.22.0-milestone1"},{"introduced":"0.22.0-milestone2"},{"last_affected":"0.22.0-milestone2"},{"introduced":"0.22.0-milestone3"},{"last_affected":"0.22.0-milestone3"},{"introduced":"0.22.0-milestone4"},{"last_affected":"0.22.0-milestone4"},{"introduced":"0.22.0-milestone5"},{"last_affected":"0.22.0-milestone5"},{"introduced":"0.22.0-milestone6"},{"last_affected":"0.22.0-milestone6"},{"introduced":"0.22.0-milestone7"},{"last_affected":"0.22.0-milestone7"},{"introduced":"0.22.0-milestone8"},{"last_affected":"0.22.0-milestone8"},{"introduced":"0.23.0-milestone1"},{"last_affected":"0.23.0-milestone1"},{"introduced":"1.0.0-milestone1"},{"last_affected":"1.0.0-milestone1"},{"introduced":"1.0.0-milestone10"},{"last_affected":"1.0.0-milestone10"},{"introduced":"1.0.0-milestone11"},{"last_affected":"1.0.0-milestone11"},{"introduced":"1.0.0-milestone12"},{"last_affected":"1.0.0-milestone12"},{"introduced":"1.0.0-milestone13"},{"last_affected":"1.0.0-milestone13"},{"introduced":"1.0.0-milestone14"},{"last_affected":"1.0.0-milestone14"},{"introduced":"1.0.0-milestone15"},{"last_affected":"1.0.0-milestone15"},{"introduced":"1.0.0-milestone16"},{"last_affected":"1.0.0-milestone16"},{"introduced":"1.0.0-milestone17"},{"last_affected":"1.0.0-milestone17"},{"introduced":"1.0.0-milestone18"},{"last_affected":"1.0.0-milestone18"},{"introduced":"1.0.0-milestone19"},{"last_affected":"1.0.0-milestone19"},{"introduced":"1.0.0-milestone2"},{"last_affected":"1.0.0-milestone2"},{"introduced":"1.0.0-milestone20"},{"last_affected":"1.0.0-milestone20"},{"introduced":"1.0.0-milestone21"},{"last_affected":"1.0.0-milestone21"},{"introduced":"1.0.0-milestone22"},{"last_affected":"1.0.0-milestone22"},{"introduced":"1.0.0-milestone3"},{"last_affected":"1.0.0-milestone3"},{"introduced":"1.0.0-milestone4"},{"last_affected":"1.0.0-milestone4"},{"introduced":"1.0.0-milestone5"},{"last_affected":"1.0.0-milestone5"},{"introduced":"1.0.0-milestone6"},{"last_affected":"1.0.0-milestone6"},{"introduced":"1.0.0-milestone7"},{"last_affected":"1.0.0-milestone7"},{"introduced":"1.0.0-milestone8"},{"last_affected":"1.0.0-milestone8"},{"introduced":"1.0.0-milestone9"},{"last_affected":"1.0.0-milestone9"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["0.22.0-milestone1","0.22.0-milestone2","0.22.0-milestone3","0.22.0-milestone4","0.22.0-milestone5","0.22.0-milestone6","0.22.0-milestone7","0.22.0-milestone8","0.23.0-milestone1","1.0.0-milestone1","1.0.0-milestone10","1.0.0-milestone11","1.0.0-milestone12","1.0.0-milestone13","1.0.0-milestone14","1.0.0-milestone15","1.0.0-milestone16","1.0.0-milestone17","1.0.0-milestone18","1.0.0-milestone19","1.0.0-milestone2","1.0.0-milestone20","1.0.0-milestone21","1.0.0-milestone22","1.0.0-milestone3","1.0.0-milestone4","1.0.0-milestone5","1.0.0-milestone6","1.0.0-milestone7","1.0.0-milestone8","1.0.0-milestone9","v0.21.23","v0.21.22","v0.21.21","v0.21.20","v0.21.19","v0.21.18","v0.21.16","v0.21.15","v0.21.14","v0.21.13","v0.21.12","v0.21.11","v0.21.9","v0.21.8","v0.21.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32643.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}