CVE-2023-22465

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub_MCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 15%
VendorProductVersion
typelevelhttp4s
0.1.0 ≤
𝑥
< 0.21.34
typelevelhttp4s
0.22.0 ≤
𝑥
< 0.22.15
typelevelhttp4s
0.23.0 ≤
𝑥
< 0.23.17
typelevelhttp4s
1.0.0:milestone1
typelevelhttp4s
1.0.0:milestone10
typelevelhttp4s
1.0.0:milestone11
typelevelhttp4s
1.0.0:milestone12
typelevelhttp4s
1.0.0:milestone13
typelevelhttp4s
1.0.0:milestone14
typelevelhttp4s
1.0.0:milestone15
typelevelhttp4s
1.0.0:milestone16
typelevelhttp4s
1.0.0:milestone17
typelevelhttp4s
1.0.0:milestone18
typelevelhttp4s
1.0.0:milestone19
typelevelhttp4s
1.0.0:milestone2
typelevelhttp4s
1.0.0:milestone20
typelevelhttp4s
1.0.0:milestone21
typelevelhttp4s
1.0.0:milestone22
typelevelhttp4s
1.0.0:milestone23
typelevelhttp4s
1.0.0:milestone24
typelevelhttp4s
1.0.0:milestone25
typelevelhttp4s
1.0.0:milestone26
typelevelhttp4s
1.0.0:milestone27
typelevelhttp4s
1.0.0:milestone28
typelevelhttp4s
1.0.0:milestone29
typelevelhttp4s
1.0.0:milestone3
typelevelhttp4s
1.0.0:milestone30
typelevelhttp4s
1.0.0:milestone31
typelevelhttp4s
1.0.0:milestone32
typelevelhttp4s
1.0.0:milestone33
typelevelhttp4s
1.0.0:milestone34
typelevelhttp4s
1.0.0:milestone35
typelevelhttp4s
1.0.0:milestone36
typelevelhttp4s
1.0.0:milestone37
typelevelhttp4s
1.0.0:milestone4
typelevelhttp4s
1.0.0:milestone5
typelevelhttp4s
1.0.0:milestone6
typelevelhttp4s
1.0.0:milestone7
typelevelhttp4s
1.0.0:milestone8
typelevelhttp4s
1.0.0:milestone9
𝑥
= Vulnerable software versions