CVE-2021-39185
Default CORS config allows any origin with credentials
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Default CORS config allows any origin with credentials
| Assigner | GitHub_M |
| Reserved | 2021-08-16 |
| Published | 2021-09-01 |
| Updated | 2024-08-04 |
Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6
https://github.com/http4s/http4s/releases/tag/v0.23.2
Support options
