CVE-2023-22465CWE-20

Http4s has fatal error parsing User-Agent and Server headers

High · published January 4, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00854 · 57.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-01-04T15:30Z
EPSS history
Timeline
  • 04 JAN 15:30Z
    Http4s has fatal error parsing User-Agent and Server headers
    cvelistv5