CVE-2021-39185 Default CORS config allows any origin with credentials

What is CVE-2021-39185?

CVE-2021-39185 is a critical vulnerability in http4s, published on 1 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Weakness: CWE-346

Which versions are affected by CVE-2021-39185?

22 open source packages ship an affected version, including org.http4s:http4s-server_2.12, org.http4s:http4s-server_2.10 and org.http4s:http4s-server_2.11. It affects 1 product.

Products include Typelevel Http4s.

How do I fix CVE-2021-39185?

Upgrade org.http4s:http4s-server_2.12 to a fixed version for your release line: 0.21.27, 0.22.3 or 0.23.2.

Is CVE-2021-39185 being exploited?

There is no known exploitation of CVE-2021-39185 in the wild and no public exploit code.

Other vulnerabilities in http4s

• CVE-2021-41084 Response Splitting from unsanitized headers in http4s High 8.7
• CVE-2020-5280 Local file inclusion vulnerability in http4s High 7.6
• CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers High 7.5
• CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server High 7.5
• CVE-2025-59822 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-52cf-226f-rhr6.