Security readout for executives and security teams
Plain-English summary
Some http4s applications used a default CORS setting that could trust any website while still allowing credentials. If an affected service relied on browser credentials, a malicious site could potentially cause unauthorized cross-origin access. Fixed versions are available, but exposure depends on whether the vulnerable CORS middleware/default configuration is used.
Executive priority
Prioritize remediation for authenticated browser-facing services using http4s CORS. The CVSS score is critical, fixed versions exist, and impact could include unauthorized data access or state changes if the vulnerable default is present.
Technical view
CVE-2021-39185 affects http4s CORS middleware defaults in listed 0.21, 0.22, 0.23, and 1.0.0-M releases. The issue is origin reflection with credentials and susceptibility to Null Origin Attack. It is CWE-346 with CVSS 3.1 score 9.1. The original CORS and CORSConfig implementations are deprecated.
Likely exposure
Internet or intranet Scala services using affected http4s versions and the vulnerable default CORS middleware are the primary concern. Services not using that middleware, not accepting browser credentials, or already upgraded may not be exposed.
Exploitation context
The source bundle shows no CISA KEV listing and provides no cited evidence of active exploitation. Risk is highest where authenticated browser users access affected services and CORS trust decisions protect sensitive data or state-changing actions.
Researcher notes
Do not assume every http4s deployment is affected. Confirm vulnerable versions and actual CORS middleware usage. The bundle does not include exploit reports, proof-of-concept details, or full workaround specifics beyond directing readers to the GitHub advisory.
Mitigation direction
- Upgrade to 0.21.27, 0.22.3, 0.23.2, or 1.0.0-M25 or later.
- Replace deprecated CORS and CORSConfig usage per http4s advisory guidance.
- Use explicit trusted origins instead of default permissive CORS behavior.
- Review services that rely on cookies, bearer tokens, or browser credentials.
- Check vendor advisory for supported workarounds if immediate upgrade is blocked.
Validation and detection
- Inventory http4s dependency versions across Scala services.
- Identify code paths enabling http4s CORS middleware.
- Check whether CORS uses default or deprecated configuration.
- Confirm deployed artifacts contain fixed http4s versions.
- Review browser-facing endpoints handling sensitive authenticated requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-346: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39185 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6CVE reference · x_refsource_CONFIRM
- https://github.com/http4s/http4s/releases/tag/v0.23.2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Origin Validation Error
Origin Validation Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.