CVE-2021-41084: Response Splitting from unsanitized headers in http4s

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-21 · updated 2026-06-17
Weakness: CWE-918

Description

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

Affected products

http4s: before 0.21.29; from 0.22.0 before 0.22.5; from 0.23.0 before 0.23.4; 1.0.0-milestone1, 1.0.0-milestone10, 1.0.0-milestone11, 1.0.0-milestone12, 1.0.0-milestone13, 1.0.0-milestone14 (+20) — fixed in 0.21.29, 0.22.5, 0.23.4

How to fix

Upgrade to a fixed version: http4s 0.21.29, 0.22.5, 0.23.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41084 or the next vulnerability affects your stack