CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers
Attackers can cause a fatal error and denial of service in Http4s services by sending malformed User-Agent or Server headers to applications that explicitly request these typed headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22465?
CVE-2023-22465 is a high-severity denial of service vulnerability in http4s, published on 4 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
Weakness: CWE-20
Which versions are affected by CVE-2023-22465?
20 open source packages ship an affected version, including org.http4s:http4s-core_2.13, org.http4s:http4s-core and org.http4s:http4s-core_2.10. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.http4s:http4s-core_2.13 Maven | From 0.1.0 | 0.21.34 |
org.http4s:http4s-core_2.13 Maven | From 0.1.0 | 0.21.34 |
org.http4s:http4s-core_2.13 Maven | From 0.22.0 | 0.22.15 |
org.http4s:http4s-core_2.13 Maven | From 0.22.0 | 0.22.15 |
org.http4s:http4s-core_2.13 Maven | From 0.23.0 | 0.23.17 |
org.http4s:http4s-core_2.13 Maven | From 0.23.0 | 0.23.17 |
14 more packages
org.http4s:http4s-core_2.13 Maven | From 1.0.0-M1 | 1.0.0-M38 |
org.http4s:http4s-core_2.13 Maven | From 1.0.0-M1 | 1.0.0-M38 |
org.http4s:http4s-core Maven | From 1.0.0-M1 to 1.0.0-M30 | None |
org.http4s:http4s-core Maven | From 1.0.0-M1 to 1.0.0-M30 | None |
org.http4s:http4s-core_2.10 Maven | From 0.1.0 to 0.9.3 | None |
org.http4s:http4s-core_2.10 Maven | From 0.1.0 to 0.9.3 | None |
org.http4s:http4s-core_2.11 Maven | From 0.1.0 to 0.21.0-M1 | None |
org.http4s:http4s-core_2.11 Maven | From 0.1.0 to 0.21.0-M1 | None |
org.http4s:http4s-core_2.12 Maven | From 0.1.0 | 0.21.34 |
org.http4s:http4s-core_2.12 Maven | From 0.1.0 | 0.21.34 |
org.http4s:http4s-core_2.12 Maven | From 0.22.0 | 0.22.15 |
org.http4s:http4s-core_2.12 Maven | From 0.22.0 | 0.22.15 |
org.http4s:http4s-core_2.12 Maven | From 0.23.0 | 0.23.17 |
org.http4s:http4s-core_2.12 Maven | From 0.23.0 | 0.23.17 |
Products include Typelevel Http4s.
How do I fix CVE-2023-22465?
Upgrade org.http4s:http4s-core_2.13 to a fixed version for your release line: 0.21.34, 0.22.15, 0.23.17 or 1.0.0-M38.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-22465 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22465 exists.
Other vulnerabilities in http4s
- CVE-2021-39185 Default CORS config allows any origin with credentials
- CVE-2021-41084 Response Splitting from unsanitized headers in http4s
- CVE-2020-5280 Local file inclusion vulnerability in http4s
- CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server
- CVE-2025-59822 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Sources
Also known as GHSA-54w6-vxfh-fw7f.