{"id":"GHSA-5vcm-3xc3-w7x3","summary":"Response Splitting from unsanitized headers","details":"### Impact\n\nhttp4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields:\n\n* Header names (`Header.name`å\n* Header values (`Header.value`)\n* Status reason phrases (`Status.reason`)\n* URI paths (`Uri.Path`)\n* URI authority registered names (`URI.RegName`) (through 0.21)\n\nThe following backends render invalid carriage return, newline, or null characters in an unsafe fashion.\n\n|                | blaze-server | ember-server | blaze-client | ember-client | jetty-client |\n|:---------------|:-------------|:-------------|:-------------|--------------|--------------|\n| header names   | ⚠            | ⚠            | ⚠            | ⚠            |   ⚠            | \n| header values  | ⚠            | ⚠            | ⚠            | ⚠            |              |\n| status reasons | ⚠            | ⚠            |              |              |              |\n| URI paths      |              |              |  ⚠             |  ⚠             |              |\n| URI regnames   |              |              |  ⚠ \u003c 0.22           |  ⚠ \u003c 0.22            |              |\n\nFor example, given the following service:\n\n```scala\nimport cats.effect._\nimport org.http4s._\nimport org.http4s.dsl.io._\nimport org.http4s.server.blaze.BlazeServerBuilder\nimport scala.concurrent.ExecutionContext.global\n\nobject ResponseSplit extends IOApp {\n  override def run(args: List[String]): IO[ExitCode] =\n    BlazeServerBuilder[IO](global)\n      .bindHttp(8080)\n      .withHttpApp(httpApp)\n      .resource\n      .use(_ =\u003e IO.never)\n\n  val httpApp: HttpApp[IO] =\n    HttpApp[IO] { req =\u003e\n      req.params.get(\"author\") match {\n        case Some(author) =\u003e\n          Ok(\"The real content\")\n            .map(_.putHeaders(Header(\"Set-Cookie\", s\"author=${author}\")))\n        case None =\u003e\n          BadRequest(\"No author parameter\")\n      }\n    }\n}\n```\n\nA clean `author` parameter returns a clean response:\n\n```sh\ncurl -i 'http://localhost:8080/?author=Ross'\n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/plain; charset=UTF-8\nSet-Cookie: author=Ross\nDate: Mon, 20 Sep 2021 04:12:10 GMT\nContent-Length: 16\n\nThe real content\n```\n\nA malicious `author` parameter allows a user-agent to hijack the response from our server and return different content:\n\n```sh\ncurl -i 'http://localhost:8080/?author=hax0r%0d%0aContent-Length:+13%0d%0a%0aI+hacked+you'\n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/plain; charset=UTF-8\nSet-Cookie: author=hax0r\nContent-Length: 13\n\nI hacked you\n```\n\n### Patches\n\nVersions 0.21.29, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following:\n\n* If a status reasoon phrase is invalid, it is dropped. Rendering is optional per spec.\n* If a header name is invalid in a request or response, the header is dropped.  There is no way to generically sanitize a header without potentially shadowing a correct one.\n* If a header value is invalid in a request or response, it is sanitized by replacing null (`\\u0000`), carriage return (`\\r`), and newline (`\\n`) with space (` `) characters per spec.\n* If a URI path or registered name is invalid in a request line, the client raises an `IllegalArgumentException`.\n* If a URI registered name is invalid in a host header, the client raises an `IllegalArgumentException`. \n\n### Workarounds\n\nhttp4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend.  The carriage return, newline, and null characters are the most threatening.\n\nNot all backends were affected: jetty-server, tomcat-server, armeria, and netty on the server; async-http-client, okhttp-client, armeria, and netty as clients.\n\n### References\n* https://owasp.org/www-community/attacks/HTTP_Response_Splitting\n* https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [GitHub](http://github.com/http4s/http4s)\n* Contact us via the [http4s security policy](https://github.com/http4s/http4s/security/policy)","aliases":["CVE-2021-41084"],"modified":"2026-07-08T06:27:29.641386159Z","published":"2021-09-22T19:18:41Z","database_specific":{"github_reviewed_at":"2021-09-21T16:10:13Z","nvd_published_at":"2021-09-21T18:15:00Z","cwe_ids":["CWE-74","CWE-918"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41084"},{"type":"WEB","url":"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"},{"type":"WEB","url":"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values"},{"type":"WEB","url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting"}],"affected":[{"package":{"name":"org.http4s:http4s-client_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.29"}]}],"versions":["0.10.0-M10","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.21.28","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.22.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.29"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.21.28","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.22.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-client_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.29"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json","last_known_affected_version_range":"\u003c= 0.21.28"}},{"package":{"name":"org.http4s:http4s-client_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json","last_known_affected_version_range":"\u003c= 0.22.4"}},{"package":{"name":"org.http4s:http4s-client_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.10","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.28"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.0a","0.13.1","0.13.1a","0.13.2","0.13.2a","0.13.3","0.13.3a","0.14.0","0.14.0a","0.14.1","0.14.10","0.14.10a","0.14.11","0.14.11a","0.14.1a","0.14.2","0.14.2a","0.14.3","0.14.3a","0.14.4","0.14.4a","0.14.5","0.14.5a","0.14.6","0.14.6a","0.14.7","0.14.7a","0.14.8","0.14.8a","0.14.9","0.14.9a","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.2.0","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.11","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.28"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.0a","0.13.1","0.13.1a","0.13.2","0.13.2a","0.13.3","0.13.3a","0.14.0","0.14.0a","0.14.1","0.14.10","0.14.10a","0.14.11","0.14.11a","0.14.1a","0.14.2","0.14.2a","0.14.3","0.14.3a","0.14.4","0.14.4a","0.14.5","0.14.5a","0.14.6","0.14.6a","0.14.7","0.14.7a","0.14.8","0.14.8a","0.14.9","0.14.9a","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.2.0","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0-M1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.29"}]}],"versions":["0.10.0-M10","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json","last_known_affected_version_range":"\u003c= 0.21.28"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.22.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.29"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.21.28","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.22.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_2.13.0-M5","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_2.13.0-M5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.28"}]}],"versions":["0.20.0","0.20.0-RC1","0.20.1","0.20.10","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.5"}]}],"versions":["0.22.0","0.22.1","0.22.2","0.22.3","0.22.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.22.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}},{"package":{"name":"org.http4s:http4s-server_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-server_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.4"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.23.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5vcm-3xc3-w7x3/GHSA-5vcm-3xc3-w7x3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"}]}