{"id":"GHSA-54w6-vxfh-fw7f","summary":"Http4s improperly parses User-Agent and Server headers","details":"### Impact\n\nThe `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. \n\n#### v0.21.x\n\n```scala\nval unsafe: Option[`User-Agent`] = req.headers.get(`User-Agent`)\n```\n\n#### v0.22.x, v0.23.x, v1.x\n\n```scala\nval unsafe: Option[`User-Agent`] = req.headers.get[`User-Agent`]\nval alsoUnsafe: Option[`Server`] = req.headers.get[Server]\n```\n\n### Patches\n\nFixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38.\n\n### Workarounds\n\n#### Use the weakly typed header interface\n\n##### v0.21.x\n\n```scala\nval safe: Option[Header] = req.headers.get(\"User-Agent\".ci)\n// but don't do this\nval unsafe = header.map(_.parsed) \n```\n\n##### v0.22.x, v0.23.x, v1.x\n\n```scala\nval safe: Option[Header] = req.headers.get(ci\"User-Agent\")\n```","aliases":["CVE-2023-22465"],"modified":"2025-12-11T21:14:46.403160Z","published":"2023-01-06T20:24:36Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-01-06T20:24:36Z","nvd_published_at":"2023-01-04T16:15:00Z","cwe_ids":["CWE-20"]},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22465"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"}],"affected":[{"package":{"name":"org.http4s:http4s-core_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.34"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.15"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.17"}]}],"versions":["0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M38"}]}],"versions":["1.0.0-M10","1.0.0-M11","1.0.0-M13","1.0.0-M14","1.0.0-M15","1.0.0-M16","1.0.0-M17","1.0.0-M18","1.0.0-M19","1.0.0-M2","1.0.0-M20","1.0.0-M21","1.0.0-M22","1.0.0-M23","1.0.0-M24","1.0.0-M25","1.0.0-M27","1.0.0-M28","1.0.0-M29","1.0.0-M3","1.0.0-M30","1.0.0-M31","1.0.0-M32","1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M4","1.0.0-M5","1.0.0-M6","1.0.0-M7","1.0.0-M8","1.0.0-M9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.10","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"0.9.3"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.11","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"0.21.0-M1"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.13.0","0.13.0a","0.13.1","0.13.1a","0.13.2","0.13.2a","0.13.3","0.13.3a","0.14.0","0.14.0a","0.14.1","0.14.10","0.14.10a","0.14.11","0.14.11a","0.14.1a","0.14.2","0.14.2a","0.14.3","0.14.3a","0.14.4","0.14.4a","0.14.5","0.14.5a","0.14.6","0.14.6a","0.14.7","0.14.7a","0.14.8","0.14.8a","0.14.9","0.14.9a","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.2.0","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0-M1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","0.9.1","0.9.2","0.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.21.34"}]}],"versions":["0.10.0-M10","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0"},{"fixed":"0.22.15"}]}],"versions":["0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.23.0"},{"fixed":"0.23.17"}]}],"versions":["0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.2","0.23.3","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}},{"package":{"name":"org.http4s:http4s-core","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"last_affected":"1.0.0-M30"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-54w6-vxfh-fw7f/GHSA-54w6-vxfh-fw7f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}