StaticFile.fromUrl can leak presence of a directory
Priority LOW 29CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.
Why it matters now
EPSS 0.01395 72nd percentileScored 2026-11-07
Fix Fixed http4s (http4s): 0.21.24, 1.0.0-M23org.http4s:http4s-core (Maven): 0.21.24, 0.22.0-RC1, 0.23.0-RC1 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | http4s | 0.21.7 to before 0.21.24; 0.22.0-M1 – 0.22.0-M8; = 0.23.0-M1; 1.0.0-M1 to before 1.0.0-M23 | 0.21.24, 1.0.0-M23 | Patch available | CNA |
| — | org.http4s:http4s-core (Maven) | 0.21.7 to before 0.21.24 | 0.21.24 | Patch available | GHSA-6h7w-fc84-x7p6 |
| — | org.http4s:http4s-core (Maven) | 0.22.0-M1 to before 0.22.0-RC1 | 0.22.0-RC1 | Patch available | GHSA-6h7w-fc84-x7p6 |
| — | org.http4s:http4s-core (Maven) | 0.23.0-M1 to before 0.23.0-RC1 | 0.23.0-RC1 | Patch available | GHSA-6h7w-fc84-x7p6 |
| — | org.http4s:http4s-core (Maven) | 1.0.0-M1 to before 1.0.0-M23 | 1.0.0-M23 | Patch available | GHSA-6h7w-fc84-x7p6 |
- http4s Vendorhttp4s Affected 0.21.7 to before 0.21.24; 0.22.0-M1 – 0.22.0-M8; = 0.23.0-M1; 1.0.0-M1 to before 1.0.0-M23 Fixed in 0.21.24, 1.0.0-M23 Patch available CNA
- org.http4s:http4s-core (Maven) Vendor— Affected 0.21.7 to before 0.21.24 Fixed in 0.21.24 Patch available GHSA-6h7w-fc84-x7p6
- org.http4s:http4s-core (Maven) Vendor— Affected 0.22.0-M1 to before 0.22.0-RC1 Fixed in 0.22.0-RC1 Patch available GHSA-6h7w-fc84-x7p6
- org.http4s:http4s-core (Maven) Vendor— Affected 0.23.0-M1 to before 0.23.0-RC1 Fixed in 0.23.0-RC1 Patch available GHSA-6h7w-fc84-x7p6
- org.http4s:http4s-core (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M23 Fixed in 1.0.0-M23 Patch available GHSA-6h7w-fc84-x7p6
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* | 0.21.7 to before 0.21.24 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone1:*:*:*:*:*:* | 0.22.0 milestone1 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone2:*:*:*:*:*:* | 0.22.0 milestone2 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone3:*:*:*:*:*:* | 0.22.0 milestone3 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone4:*:*:*:*:*:* | 0.22.0 milestone4 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone5:*:*:*:*:*:* | 0.22.0 milestone5 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone6:*:*:*:*:*:* | 0.22.0 milestone6 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone7:*:*:*:*:*:* | 0.22.0 milestone7 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.22.0:milestone8:*:*:*:*:*:* | 0.22.0 milestone8 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.23.0:milestone1:*:*:*:*:*:* | 0.23.0 milestone1 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions 0.21.7 to before 0.21.24 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone1:*:*:*:*:*:* Versions 0.22.0 milestone1 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone2:*:*:*:*:*:* Versions 0.22.0 milestone2 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone3:*:*:*:*:*:* Versions 0.22.0 milestone3 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone4:*:*:*:*:*:* Versions 0.22.0 milestone4 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone5:*:*:*:*:*:* Versions 0.22.0 milestone5 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone6:*:*:*:*:*:* Versions 0.22.0 milestone6 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone7:*:*:*:*:*:* Versions 0.22.0 milestone7 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone8:*:*:*:*:*:* Versions 0.22.0 milestone8 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.23.0:milestone1:*:*:*:*:*:* Versions 0.23.0 milestone1 Vulnerable ·http4s
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* | 1.0.0 milestone1 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* | 1.0.0 milestone10 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* | 1.0.0 milestone11 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* | 1.0.0 milestone12 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* | 1.0.0 milestone13 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* | 1.0.0 milestone14 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* | 1.0.0 milestone15 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* | 1.0.0 milestone16 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* | 1.0.0 milestone17 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* | 1.0.0 milestone18 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* | 1.0.0 milestone19 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* | 1.0.0 milestone2 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* | 1.0.0 milestone20 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* | 1.0.0 milestone21 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* | 1.0.0 milestone22 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* | 1.0.0 milestone3 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* | 1.0.0 milestone4 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* | 1.0.0 milestone5 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* | 1.0.0 milestone6 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* | 1.0.0 milestone7 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* | 1.0.0 milestone8 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* | 1.0.0 milestone9 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* Versions 1.0.0 milestone1 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* Versions 1.0.0 milestone10 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* Versions 1.0.0 milestone11 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* Versions 1.0.0 milestone12 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* Versions 1.0.0 milestone13 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* Versions 1.0.0 milestone14 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* Versions 1.0.0 milestone15 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* Versions 1.0.0 milestone16 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* Versions 1.0.0 milestone17 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* Versions 1.0.0 milestone18 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* Versions 1.0.0 milestone19 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* Versions 1.0.0 milestone2 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* Versions 1.0.0 milestone20 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* Versions 1.0.0 milestone21 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* Versions 1.0.0 milestone22 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* Versions 1.0.0 milestone3 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* Versions 1.0.0 milestone4 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* Versions 1.0.0 milestone5 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* Versions 1.0.0 milestone6 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* Versions 1.0.0 milestone7 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* Versions 1.0.0 milestone8 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* Versions 1.0.0 milestone9 Vulnerable ·http4s
Remediation
- Fix · CNA http4s (http4s) Fixed in 0.21.24, 1.0.0-M23
- Fix · GHSA-6h7w-fc84-x7p6 org.http4s:http4s-core (Maven) Fixed in 0.21.24 Advisory →
- Fix · GHSA-6h7w-fc84-x7p6 org.http4s:http4s-core (Maven) Fixed in 0.22.0-RC1 Advisory →
- Fix · GHSA-6h7w-fc84-x7p6 org.http4s:http4s-core (Maven) Fixed in 0.23.0-RC1 Advisory →
- Fix · GHSA-6h7w-fc84-x7p6 org.http4s:http4s-core (Maven) Fixed in 1.0.0-M23 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32643
- 2026-10-03 Alias added: GHSA-6h7w-fc84-x7p6
References
More Http4s vulnerabilities
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
- TI-2021-17927 Response Splitting from unsanitized headers in http4s CVSS 3.1HIGH 8.7
- TI-2021-16571 Default CORS config allows any origin with credentials CVSS 3.1CRITICAL 9.1
- TI-2021-04394 Unbounded connection acceptance in http4s-blaze-server CVSS 3.1HIGH 7.5
Sources
- CVE-2021-32643 · CVE Program
- CVE-2021-32643 · NVD
- FIRST EPSS
- GHSA-6h7w-fc84-x7p6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences