org.http4s:http4s-server_2.12 (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.http4s:http4s-server_2.12, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2021-39185 — CVSS 9.1 (critical): Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0…
• CVE-2021-41084 — CVSS 8.7 (high): http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting…
• CVE-2020-5280 — CVSS 7.6 (high): http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of…