Read the docs
TI-2023-08714 Aliases CVE-2023-22465GHSA-54w6-vxfh-fw7f

Http4s has fatal error parsing User-Agent and Server headers

Priority HIGH 72CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00886 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed http4s (http4s): 0.21.34, 0.22.15, 0.23.17 +1org.http4s:http4s-core_2.13 (Maven): 0.21.34, 0.22.15, 0.23.17 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
http4shttp4s0.1.0 to before 0.21.34; 0.22.0 to before 0.22.15; 0.23.0 to before 0.23.17; 1.0.0-M1 to before 1.0.0-M380.21.34, 0.22.15, 0.23.17, 1.0.0-M38Patch availableCNA
—org.http4s:http4s-core_2.13 (Maven)0.1.0 to before 0.21.340.21.34Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.13 (Maven)0.22.0 to before 0.22.150.22.15Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.13 (Maven)0.23.0 to before 0.23.170.23.17Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.13 (Maven)1.0.0-M1 to before 1.0.0-M381.0.0-M38Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.10 (Maven)0.1.0 – 0.9.3—No fix listedGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.11 (Maven)0.1.0 – 0.21.0-M1—No fix listedGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.12 (Maven)0.1.0 to before 0.21.340.21.34Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.12 (Maven)0.22.0 to before 0.22.150.22.15Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core_2.12 (Maven)0.23.0 to before 0.23.170.23.17Patch availableGHSA-54w6-vxfh-fw7f
—org.http4s:http4s-core (Maven)1.0.0-M1 – 1.0.0-M30—No fix listedGHSA-54w6-vxfh-fw7f
  • http4s Vendorhttp4s Affected 0.1.0 to before 0.21.34; 0.22.0 to before 0.22.15; 0.23.0 to before 0.23.17; 1.0.0-M1 to before 1.0.0-M38 Fixed in 0.21.34, 0.22.15, 0.23.17, 1.0.0-M38 Patch available CNA
  • org.http4s:http4s-core_2.13 (Maven) Vendor— Affected 0.1.0 to before 0.21.34 Fixed in 0.21.34 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.13 (Maven) Vendor— Affected 0.22.0 to before 0.22.15 Fixed in 0.22.15 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.13 (Maven) Vendor— Affected 0.23.0 to before 0.23.17 Fixed in 0.23.17 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.13 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M38 Fixed in 1.0.0-M38 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.10 (Maven) Vendor— Affected 0.1.0 – 0.9.3 Fixed in — No fix listed GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.11 (Maven) Vendor— Affected 0.1.0 – 0.21.0-M1 Fixed in — No fix listed GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.12 (Maven) Vendor— Affected 0.1.0 to before 0.21.34 Fixed in 0.21.34 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.12 (Maven) Vendor— Affected 0.22.0 to before 0.22.15 Fixed in 0.22.15 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core_2.12 (Maven) Vendor— Affected 0.23.0 to before 0.23.17 Fixed in 0.23.17 Patch available GHSA-54w6-vxfh-fw7f
  • org.http4s:http4s-core (Maven) Vendor— Affected 1.0.0-M1 – 1.0.0-M30 Fixed in — No fix listed GHSA-54w6-vxfh-fw7f

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*0.1.0 to before 0.21.34; 0.22.0 to before 0.22.15; 0.23.0 to before 0.23.17Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*1.0.0 milestone1Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*1.0.0 milestone10Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*1.0.0 milestone11Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*1.0.0 milestone12Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*1.0.0 milestone13Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*1.0.0 milestone14Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*1.0.0 milestone15Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*1.0.0 milestone16Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*1.0.0 milestone17Vulnerablehttp4s
  • cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions 0.1.0 to before 0.21.34; 0.22.0 to before 0.22.15; 0.23.0 to before 0.23.17 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:* Versions 1.0.0 milestone1 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:* Versions 1.0.0 milestone10 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:* Versions 1.0.0 milestone11 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:* Versions 1.0.0 milestone12 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:* Versions 1.0.0 milestone13 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:* Versions 1.0.0 milestone14 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:* Versions 1.0.0 milestone15 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:* Versions 1.0.0 milestone16 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:* Versions 1.0.0 milestone17 Vulnerable ·http4s
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*1.0.0 milestone18Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*1.0.0 milestone19Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*1.0.0 milestone2Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*1.0.0 milestone20Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*1.0.0 milestone21Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*1.0.0 milestone22Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*1.0.0 milestone23Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*1.0.0 milestone24Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*1.0.0 milestone25Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*1.0.0 milestone26Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:*1.0.0 milestone27Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:*1.0.0 milestone28Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:*1.0.0 milestone29Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*1.0.0 milestone3Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:*1.0.0 milestone30Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:*1.0.0 milestone31Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:*1.0.0 milestone32Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:*1.0.0 milestone33Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:*1.0.0 milestone34Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:*1.0.0 milestone35Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:*1.0.0 milestone36Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:*1.0.0 milestone37Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*1.0.0 milestone4Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*1.0.0 milestone5Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*1.0.0 milestone6Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*1.0.0 milestone7Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*1.0.0 milestone8Vulnerablehttp4s
cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*1.0.0 milestone9Vulnerablehttp4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:* Versions 1.0.0 milestone18 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:* Versions 1.0.0 milestone19 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:* Versions 1.0.0 milestone2 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:* Versions 1.0.0 milestone20 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:* Versions 1.0.0 milestone21 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:* Versions 1.0.0 milestone22 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:* Versions 1.0.0 milestone23 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:* Versions 1.0.0 milestone24 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:* Versions 1.0.0 milestone25 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:* Versions 1.0.0 milestone26 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone27:*:*:*:*:*:* Versions 1.0.0 milestone27 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone28:*:*:*:*:*:* Versions 1.0.0 milestone28 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone29:*:*:*:*:*:* Versions 1.0.0 milestone29 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:* Versions 1.0.0 milestone3 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone30:*:*:*:*:*:* Versions 1.0.0 milestone30 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone31:*:*:*:*:*:* Versions 1.0.0 milestone31 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone32:*:*:*:*:*:* Versions 1.0.0 milestone32 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone33:*:*:*:*:*:* Versions 1.0.0 milestone33 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone34:*:*:*:*:*:* Versions 1.0.0 milestone34 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone35:*:*:*:*:*:* Versions 1.0.0 milestone35 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone36:*:*:*:*:*:* Versions 1.0.0 milestone36 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone37:*:*:*:*:*:* Versions 1.0.0 milestone37 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:* Versions 1.0.0 milestone4 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:* Versions 1.0.0 milestone5 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:* Versions 1.0.0 milestone6 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:* Versions 1.0.0 milestone7 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:* Versions 1.0.0 milestone8 Vulnerable ·http4s
  • cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:* Versions 1.0.0 milestone9 Vulnerable ·http4s

Remediation

  • Fix · CNA http4s (http4s) Fixed in 0.21.34, 0.22.15, 0.23.17, 1.0.0-M38
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.13 (Maven) Fixed in 0.21.34 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.13 (Maven) Fixed in 0.22.15 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.13 (Maven) Fixed in 0.23.17 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.13 (Maven) Fixed in 1.0.0-M38 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.12 (Maven) Fixed in 0.21.34 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.12 (Maven) Fixed in 0.22.15 Advisory →
  • Fix · GHSA-54w6-vxfh-fw7f org.http4s:http4s-core_2.12 (Maven) Fixed in 0.23.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22465
  2. 2026-10-03 Alias added: GHSA-54w6-vxfh-fw7f

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
  • TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
  • TI-2021-17927 Response Splitting from unsanitized headers in http4s CVSS 3.1HIGH 8.7
  • TI-2021-16571 Default CORS config allows any origin with credentials CVSS 3.1CRITICAL 9.1
  • TI-2021-04394 Unbounded connection acceptance in http4s-blaze-server CVSS 3.1HIGH 7.5
  • TI-2021-12311 StaticFile.fromUrl can leak presence of a directory CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences