← Vulnerability feed

Vulnerability record · CVE-2021-39185 · published 1 September 2021

CVE-2021-39185: Typelevel http4s origin validation error vulnerability

Typelevel · Http4s

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

9.1 CVSS 3.1 Critical EPSS 0.59% · top 53.8% CWE-346 · Origin validation error
9.1CVSS 3.1 base score, v2 6.4
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/http4s/http4s/releases/tag/v0.23.2 Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6 PatchThird Party Advisory
https://github.com/http4s/http4s/releases/tag/v0.23.2 Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6 PatchThird Party Advisory

Track CVE-2021-39185 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-21294Typelevel http4s uncontrolled resource consumption vulnerabilityHttp4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have…EPSS 2.1%7.5CVE-2020-5280Typelevel http4s relative path traversal vulnerabilityhttp4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.s…EPSS 7.0%6.3CVE-2025-59822Typelevel http4s http request smuggling vulnerabilityHttp4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request…EPSS 0.37%5.8CVE-2021-32643Typelevel http4s path traversal vulnerabilityHttp4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `fi…EPSS 1.4%5.3CVE-2023-22465Typelevel http4s improper input validation vulnerabilityHttp4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-…EPSS 0.85%4.7CVE-2021-41084Typelevel http4s server-side request forgery (ssrf) vulnerabilityhttp4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when …EPSS 1.2%9.4CVE-2025-34291Langflow CORS misconfiguration leads to token theft and RCELangflow up to and including 1.6.9 ships an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token …KEVEPSS 93%analysed8.8CVE-2015-4495Firefox PDF reader same-origin bypass allows file read and privilege gainThe PDF reader in Mozilla Firefox (before 39.0.3), Firefox ESR 38.x (before 38.1.1), and Firefox OS (before 2.2) fails to properly validate origin, l…KEVEPSS 69%analysed

Source: NIST National Vulnerability Database (record CVE-2021-39185), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.