Read the docs
TI-2020-04336 Aliases CVE-2020-5280GHSA-66q9-f7ff-mmx6

Local file inclusion vulnerability in http4s

Priority MEDIUM 43CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

Why it matters now

EPSS 0.06985 94th percentileScored 2026-11-07
Fix Fixed http4s (http4s): 0.18.26, 0.20.20, 0.21.2org.http4s:http4s-server_2.12 (Maven): 0.18.26, 0.20.20, 0.21.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
http4shttp4sbefore 0.18.26; 0.19.0 to before 0.20.20; 0.21.0 to before 0.21.20.18.26, 0.20.20, 0.21.2Patch availableCNA
—org.http4s:http4s-server_2.12 (Maven)before 0.18.260.18.26Patch availableGHSA-66q9-f7ff-mmx6
—org.http4s:http4s-server_2.12 (Maven)0.19.0 to before 0.20.200.20.20Patch availableGHSA-66q9-f7ff-mmx6
—org.http4s:http4s-server_2.12 (Maven)0.21.0 to before 0.21.20.21.2Patch availableGHSA-66q9-f7ff-mmx6
  • http4s Vendorhttp4s Affected before 0.18.26; 0.19.0 to before 0.20.20; 0.21.0 to before 0.21.2 Fixed in 0.18.26, 0.20.20, 0.21.2 Patch available CNA
  • org.http4s:http4s-server_2.12 (Maven) Vendor— Affected before 0.18.26 Fixed in 0.18.26 Patch available GHSA-66q9-f7ff-mmx6
  • org.http4s:http4s-server_2.12 (Maven) Vendor— Affected 0.19.0 to before 0.20.20 Fixed in 0.20.20 Patch available GHSA-66q9-f7ff-mmx6
  • org.http4s:http4s-server_2.12 (Maven) Vendor— Affected 0.21.0 to before 0.21.2 Fixed in 0.21.2 Patch available GHSA-66q9-f7ff-mmx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*before 0.18.26; 0.19.0 to before 0.20.20; 0.21.0 to before 0.21.2Vulnerablehttp4s
  • cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions before 0.18.26; 0.19.0 to before 0.20.20; 0.21.0 to before 0.21.2 Vulnerable ·http4s

Remediation

  • Fix · CNA http4s (http4s) Fixed in 0.18.26, 0.20.20, 0.21.2
  • Fix · GHSA-66q9-f7ff-mmx6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.18.26 Advisory →
  • Fix · GHSA-66q9-f7ff-mmx6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.20.20 Advisory →
  • Fix · GHSA-66q9-f7ff-mmx6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.21.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5280
  2. 2026-10-03 Alias added: GHSA-66q9-f7ff-mmx6

References

Patch 3

Advisory 2

  • TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
  • TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
  • TI-2021-17927 Response Splitting from unsanitized headers in http4s CVSS 3.1HIGH 8.7
  • TI-2021-16571 Default CORS config allows any origin with credentials CVSS 3.1CRITICAL 9.1
  • TI-2021-04394 Unbounded connection acceptance in http4s-blaze-server CVSS 3.1HIGH 7.5
  • TI-2021-12311 StaticFile.fromUrl can leak presence of a directory CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences