Default CORS config allows any origin with credentials
Priority MEDIUM 40CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.
Why it matters now
EPSS 0.00594 48th percentileScored 2026-11-07
Fix Fixed http4s (http4s): 0.21.27, 0.22.3, 0.23.2org.http4s:http4s-server_3 (Maven): 0.22.3, 0.23.2+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | http4s | before 0.21.27; 0.22.0 to before 0.22.3; 0.23.0 to before 0.23.2; 1.0.0-M1 – 1.0.0-M24 | 0.21.27, 0.22.3, 0.23.2 | Patch available | CNA |
| — | org.http4s:http4s-server_2.13.0-M5 (Maven) | all versions | — | No fix listed | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_3 (Maven) | 0.22.0 to before 0.22.3 | 0.22.3 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_3 (Maven) | 0.23.0 to before 0.23.2 | 0.23.2 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.10 (Maven) | all versions | — | No fix listed | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.11 (Maven) | all versions | — | No fix listed | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.12 (Maven) | before 0.21.27 | 0.21.27 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.12 (Maven) | 0.22.0 to before 0.22.3 | 0.22.3 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.12 (Maven) | 0.23.0 to before 0.23.2 | 0.23.2 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.13 (Maven) | before 0.21.27 | 0.21.27 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.13 (Maven) | 0.22.0 to before 0.22.3 | 0.22.3 | Patch available | GHSA-52cf-226f-rhr6 |
| — | org.http4s:http4s-server_2.13 (Maven) | 0.23.0 to before 0.23.2 | 0.23.2 | Patch available | GHSA-52cf-226f-rhr6 |
- http4s Vendorhttp4s Affected before 0.21.27; 0.22.0 to before 0.22.3; 0.23.0 to before 0.23.2; 1.0.0-M1 – 1.0.0-M24 Fixed in 0.21.27, 0.22.3, 0.23.2 Patch available CNA
- org.http4s:http4s-server_2.13.0-M5 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_3 (Maven) Vendor— Affected 0.22.0 to before 0.22.3 Fixed in 0.22.3 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_3 (Maven) Vendor— Affected 0.23.0 to before 0.23.2 Fixed in 0.23.2 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.10 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.11 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.12 (Maven) Vendor— Affected before 0.21.27 Fixed in 0.21.27 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.12 (Maven) Vendor— Affected 0.22.0 to before 0.22.3 Fixed in 0.22.3 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.12 (Maven) Vendor— Affected 0.23.0 to before 0.23.2 Fixed in 0.23.2 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.13 (Maven) Vendor— Affected before 0.21.27 Fixed in 0.21.27 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.13 (Maven) Vendor— Affected 0.22.0 to before 0.22.3 Fixed in 0.22.3 Patch available GHSA-52cf-226f-rhr6
- org.http4s:http4s-server_2.13 (Maven) Vendor— Affected 0.23.0 to before 0.23.2 Fixed in 0.23.2 Patch available GHSA-52cf-226f-rhr6
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* | up to 0.21.26; 0.22.0 – 0.22.2 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:* | 0.23.0 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:* | 0.23.1 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* | 1.0.0 milestone1 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* | 1.0.0 milestone10 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* | 1.0.0 milestone11 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* | 1.0.0 milestone12 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* | 1.0.0 milestone13 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* | 1.0.0 milestone14 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* | 1.0.0 milestone15 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions up to 0.21.26; 0.22.0 – 0.22.2 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:* Versions 0.23.0 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:* Versions 0.23.1 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* Versions 1.0.0 milestone1 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* Versions 1.0.0 milestone10 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* Versions 1.0.0 milestone11 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* Versions 1.0.0 milestone12 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* Versions 1.0.0 milestone13 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* Versions 1.0.0 milestone14 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* Versions 1.0.0 milestone15 Vulnerable ·http4s
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* | 1.0.0 milestone16 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* | 1.0.0 milestone17 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* | 1.0.0 milestone18 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* | 1.0.0 milestone19 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* | 1.0.0 milestone2 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* | 1.0.0 milestone20 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* | 1.0.0 milestone21 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* | 1.0.0 milestone22 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:* | 1.0.0 milestone23 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:* | 1.0.0 milestone24 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* | 1.0.0 milestone3 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* | 1.0.0 milestone4 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* | 1.0.0 milestone5 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* | 1.0.0 milestone6 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* | 1.0.0 milestone7 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* | 1.0.0 milestone8 | Vulnerable | http4s |
| cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* | 1.0.0 milestone9 | Vulnerable | http4s |
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* Versions 1.0.0 milestone16 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* Versions 1.0.0 milestone17 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* Versions 1.0.0 milestone18 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* Versions 1.0.0 milestone19 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* Versions 1.0.0 milestone2 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* Versions 1.0.0 milestone20 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* Versions 1.0.0 milestone21 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* Versions 1.0.0 milestone22 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:* Versions 1.0.0 milestone23 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:* Versions 1.0.0 milestone24 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* Versions 1.0.0 milestone3 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* Versions 1.0.0 milestone4 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* Versions 1.0.0 milestone5 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* Versions 1.0.0 milestone6 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* Versions 1.0.0 milestone7 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* Versions 1.0.0 milestone8 Vulnerable ·http4s
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* Versions 1.0.0 milestone9 Vulnerable ·http4s
Remediation
- Fix · CNA http4s (http4s) Fixed in 0.21.27, 0.22.3, 0.23.2
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_3 (Maven) Fixed in 0.22.3 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_3 (Maven) Fixed in 0.23.2 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.21.27 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.22.3 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.12 (Maven) Fixed in 0.23.2 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.13 (Maven) Fixed in 0.21.27 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.13 (Maven) Fixed in 0.22.3 Advisory →
- Fix · GHSA-52cf-226f-rhr6 org.http4s:http4s-server_2.13 (Maven) Fixed in 0.23.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39185
- 2026-10-03 Alias added: GHSA-52cf-226f-rhr6
References
More Http4s vulnerabilities
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
- TI-2021-17927 Response Splitting from unsanitized headers in http4s CVSS 3.1HIGH 8.7
- TI-2021-04394 Unbounded connection acceptance in http4s-blaze-server CVSS 3.1HIGH 7.5
- TI-2021-12311 StaticFile.fromUrl can leak presence of a directory CVSS 3.1MEDIUM 5.8
Sources
- CVE-2021-39185 · CVE Program
- CVE-2021-39185 · NVD
- FIRST EPSS
- GHSA-52cf-226f-rhr6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences