Security readout for executives and security teams
Plain-English summary
http4s versions listed in the advisory can let unsafe user input break HTTP message structure when placed into headers, status reason phrases, or certain URI fields. In the wrong application flow, this can let an attacker influence downstream responses or requests, creating confidentiality and integrity risk. The issue is fixed in named http4s releases.
Executive priority
Treat this as a high-priority dependency and input-validation issue where http4s is used in internet-facing or proxy-like services. Upgrade is the cleanest control. Business urgency is lower if affected versions are absent or untrusted input never reaches the vulnerable fields.
Technical view
The source describes response-splitting or request-splitting caused by unsanitized carriage return, newline, or null characters in http4s Header names, Header values, Status.reason, Uri.Path, and URI.RegName through 0.21. Fixed versions are 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27.
Likely exposure
Exposure is limited to Scala services or clients using affected http4s versions and constructing the listed HTTP fields from untrusted input. Public-facing endpoints, proxying services, redirects, and backend request builders deserve priority review.
Exploitation context
The bundle marks KEV as false, and no supplied source states active exploitation. The CVSS vector is network reachable with no privileges or user interaction, but high attack complexity. Exploitability depends on application-specific input flow into vulnerable HTTP metadata.
Researcher notes
The supplied CWE is CWE-918, but the described weakness is HTTP response/request splitting through unsafe field construction. Do not assume exploitability from version alone; validate whether attacker-controlled data reaches the specific http4s constructors or response/request metadata paths.
Mitigation direction
- Upgrade http4s to 0.21.30, 0.22.5, 0.23.4, 1.0.0-M27, or later.
- Sanitize or reject untrusted input before constructing the listed HTTP fields.
- Block carriage return, newline, and null characters in those fields.
- Review vendor advisory before choosing backports or compensating controls.
Validation and detection
- Inventory deployed Scala services and clients for affected http4s version ranges.
- Search code paths creating Header names, Header values, Status.reason, Uri.Path, or URI.RegName from user input.
- Confirm deployed artifacts include a fixed http4s release.
- Add regression tests that reject carriage return, newline, and null input in affected fields.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-41084 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N2.25.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3CVE reference · x_refsource_CONFIRM
- https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8CVE reference · x_refsource_MISC
- https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.valuesCVE reference · x_refsource_MISC
- https://owasp.org/www-community/attacks/HTTP_Response_SplittingCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.