CVE-2021-41084

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

• CWE-918
• CWE-74

• https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8Patch, Third Party Advisory
• https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3Exploit, Third Party Advisory
• https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.valuesVendor Advisory
• https://owasp.org/www-community/attacks/HTTP_Response_SplittingThird Party Advisory
• https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8Patch, Third Party Advisory
• https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3Exploit, Third Party Advisory
• https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.valuesVendor Advisory
• https://owasp.org/www-community/attacks/HTTP_Response_SplittingThird Party Advisory

Published

Sep 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41079Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0…7.5
• CVE-2021-4108snipe-it is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41082Discourse is a platform for community discussion. In affecte…7.5
• CVE-2021-41083Dada Mail is a web-based e-mail list management system. In a…8.8
• CVE-2021-41086jsuites is an open source collection of common required java…5.4
• CVE-2021-41087in-toto-golang is a go implementation of the in-toto framewo…6.5
• CVE-2021-41088Elvish is a programming language and interactive shell, comb…8.8
• CVE-2021-41089Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41090Grafana Agent is a telemetry collector for sending metrics, …7.5
• CVE-2021-41091Moby is an open-source project created by Docker to enable s…6.3