CVE-2021-32643

Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.

• CWE-22
• CWE-22

• https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9Patch, Third Party Advisory
• https://github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6Patch, Third Party Advisory
• https://mvnrepository.com/artifact/org.http4s/http4s-coreThird Party Advisory
• https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9Patch, Third Party Advisory
• https://github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6Patch, Third Party Advisory
• https://mvnrepository.com/artifact/org.http4s/http4s-coreThird Party Advisory

Published

May 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4
• CVE-2021-32639Emissary is a P2P-based, data-driven workflow engine. Emissa…9.9
• CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid para…7.2
• CVE-2021-32640ws is an open source WebSocket client and server library for…5.3
• CVE-2021-32641auth0-lock is Auth0's signin solution. Versions of nauth0-lo…6.1
• CVE-2021-32642radsecproxy is a generic RADIUS proxy that supports both UDP…9.4
• CVE-2021-32644Ampache is an open source web based audio/video streaming ap…5.4
• CVE-2021-32645Tenancy multi-tenant is an open source multi-domain controll…6.1
• CVE-2021-32646Roomer is a discord bot cog (extension) which provides autom…7.3
• CVE-2021-32647Emissary is a P2P based data-driven workflow engine. Affecte…9.1
• CVE-2021-32648octobercms in a CMS platform based on the Laravel PHP Framew…9.1
• CVE-2021-32649October CMS is a self-hosted content management system (CMS)…8.8