CVE-2023-22465
Http4s has fatal error parsing User-Agent and Server headers
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Http4s has fatal error parsing User-Agent and Server headers
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
- Record
CVE-2023-22465- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-0335
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
- Record
EUVD-2023-0335- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-54w6-vxfh-fw7f
Http4s improperly parses User-Agent and Server headers
Impact
The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers.
v0.21.x
val unsafe: Option[`User-Agent`] = req.headers.get(`User-Agent`)
v0.22.x, v0.23.x, v1.x
val unsafe: Option[`User-Agent`] = req.headers.get[`User-Agent`]
val alsoUnsafe: Option[`Server`] = req.headers.get[Server]
Patches
Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38.
Workarounds
Use the weakly typed header interface
v0.21.x
val safe: Option[Header] = req.headers.get("User-Agent".ci)
// but don't do this
val unsafe = header.map(_.parsed)
v0.22.x, v0.23.x, v1.x
val safe: Option[Header] = req.headers.get(ci"User-Agent")
- Record
GHSA-54w6-vxfh-fw7f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
- Record
CVE-2023-22465- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Http4s has fatal error parsing User-Agent and Server headers
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
- Record
CVE-2023-22465- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-54w6-vxfh-fw7f
Http4s improperly parses User-Agent and Server headers
Impact
The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers.
v0.21.x
val unsafe: Option[`User-Agent`] = req.headers.get(`User-Agent`)
v0.22.x, v0.23.x, v1.x
val unsafe: Option[`User-Agent`] = req.headers.get[`User-Agent`]
val alsoUnsafe: Option[`Server`] = req.headers.get[Server]
Patches
Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38.
Workarounds
Use the weakly typed header interface
v0.21.x
val safe: Option[Header] = req.headers.get("User-Agent".ci)
// but don't do this
val unsafe = header.map(_.parsed)
v0.22.x, v0.23.x, v1.x
val safe: Option[Header] = req.headers.get(ci"User-Agent")
- Record
GHSA-54w6-vxfh-fw7f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.http4s:http4s-core_2.13Maven |
0.1.0 up to 0.21.34 | 0.21.34 |
org.http4s:http4s-core_2.13Maven |
0.22.0 up to 0.22.15 | 0.22.15 |
org.http4s:http4s-core_2.13Maven |
0.23.0 up to 0.23.17 | 0.23.17 |
org.http4s:http4s-core_2.13Maven |
1.0.0-M1 up to 1.0.0-M38 | 1.0.0-M38 |
org.http4s:http4s-core_2.10Maven |
0.1.0 to 0.9.3 | None known |
org.http4s:http4s-core_2.11Maven |
0.1.0 to 0.21.0-M1 | None known |
org.http4s:http4s-core_2.12Maven |
0.1.0 up to 0.21.34 | 0.21.34 |
org.http4s:http4s-core_2.12Maven |
0.22.0 up to 0.22.15 | 0.22.15 |
org.http4s:http4s-core_2.12Maven |
0.23.0 up to 0.23.17 | 0.23.17 |
org.http4s:http4s-coreMaven |
1.0.0-M1 to 1.0.0-M30 | None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.http4s:http4s-core_2.13Maven |
0.1.0 up to 0.21.34, plus listed versions 0.10.0-M100.21.00.21.0-M10.21.0-M20.21.0-M3 Show 40 moreShow less0.21.0-M40.21.0-M50.21.0-M60.21.0-RC10.21.0-RC20.21.0-RC30.21.0-RC40.21.0-RC50.21.10.21.110.21.120.21.130.21.140.21.150.21.160.21.170.21.180.21.190.21.20.21.200.21.210.21.220.21.230.21.240.21.250.21.260.21.270.21.280.21.290.21.30.21.300.21.310.21.320.21.330.21.40.21.50.21.60.21.70.21.80.21.9 |
0.21.34 |
org.http4s:http4s-core_2.13Maven |
0.22.0 up to 0.22.15, plus listed versions 0.22-129-24d065b0.22-143-49b5a8d0.22-53-01128f50.22-96-55d31840.22.1 Show 13 moreShow less0.22.100.22.110.22.120.22.130.22.140.22.20.22.30.22.40.22.50.22.60.22.70.22.80.22.9 |
0.22.15 |
org.http4s:http4s-core_2.13Maven |
0.23.0 up to 0.23.17, plus listed versions 0.23.10.23.100.23.110.23.120.23.13 Show 11 moreShow less0.23.140.23.150.23.160.23.20.23.30.23.40.23.50.23.60.23.70.23.80.23.9 |
0.23.17 |
org.http4s:http4s-core_2.13Maven |
1.0.0-M1 up to 1.0.0-M38, plus listed versions 1.0.0-M101.0.0-M111.0.0-M131.0.0-M141.0.0-M15 Show 29 moreShow less1.0.0-M161.0.0-M171.0.0-M181.0.0-M191.0.0-M21.0.0-M201.0.0-M211.0.0-M221.0.0-M231.0.0-M241.0.0-M251.0.0-M271.0.0-M281.0.0-M291.0.0-M31.0.0-M301.0.0-M311.0.0-M321.0.0-M331.0.0-M341.0.0-M351.0.0-M361.0.0-M371.0.0-M41.0.0-M51.0.0-M61.0.0-M71.0.0-M81.0.0-M9 |
1.0.0-M38 |
org.http4s:http4s-core_2.10Maven |
0.1.0 to 0.9.3, plus listed versions 0.2.00.3.00.4.00.4.10.4.2 Show 22 moreShow less0.5.00.5.10.5.20.5.30.5.40.6.00.6.10.6.20.6.30.6.40.6.50.7.00.8.00.8.10.8.20.8.30.8.40.8.50.8.60.9.00.9.10.9.2 |
None known |
org.http4s:http4s-core_2.11Maven |
0.1.0 to 0.21.0-M1, plus listed versions 0.10.00.10.10.11.00.11.10.11.2 Show 45 moreShow less0.11.30.12.00.12.10.12.20.12.30.12.40.12.50.12.60.13.00.13.0a0.13.10.13.1a0.13.20.13.2a0.13.30.13.3a0.14.00.14.0a0.14.10.14.100.14.10a0.14.110.14.11a0.14.1a0.14.20.14.2a0.14.30.14.3a0.14.40.14.4a0.14.50.14.5a0.14.60.14.6a0.14.70.14.7a0.14.80.14.8a0.14.90.14.9a0.15.00.15.0a0.15.10.15.100.15.10a |
None known |
org.http4s:http4s-core_2.12Maven |
0.1.0 up to 0.21.34, plus listed versions 0.10.0-M100.15.00.15.0a0.15.10.15.10 Show 45 moreShow less0.15.10a0.15.110.15.11a0.15.120.15.12a0.15.130.15.13a0.15.140.15.14a0.15.150.15.15a0.15.160.15.16a0.15.1a0.15.20.15.2a0.15.30.15.3a0.15.40.15.4a0.15.50.15.5a0.15.60.15.6a0.15.70.15.7a0.15.80.15.8a0.15.90.15.9a0.16.00.16.0-M10.16.0-M20.16.0-M30.16.0-RC10.16.0-RC20.16.0-RC30.16.0a0.16.0a-M10.16.0a-M20.16.0a-M30.16.0a-RC10.16.0a-RC20.16.0a-RC30.16.1 |
0.21.34 |
org.http4s:http4s-core_2.12Maven |
0.22.0 up to 0.22.15, plus listed versions 0.22-129-24d065b0.22-143-49b5a8d0.22-53-01128f50.22-96-55d31840.22.1 Show 13 moreShow less0.22.100.22.110.22.120.22.130.22.140.22.20.22.30.22.40.22.50.22.60.22.70.22.80.22.9 |
0.22.15 |
org.http4s:http4s-core_2.12Maven |
0.23.0 up to 0.23.17, plus listed versions 0.23.10.23.100.23.110.23.120.23.13 Show 11 moreShow less0.23.140.23.150.23.160.23.20.23.30.23.40.23.50.23.60.23.70.23.80.23.9 |
0.23.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22465 is a high vulnerability (CVSS 7.5) in Http4s, published January 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in org.http4s:http4s-core_2.13 0.21.34.
References
Left out here: 310 versions. The JSON record has them.