CVE-2021-39185

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391866.1GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the usernam CVE-2021-391877.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Serve CVE-2021-391895.3Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the CVE-2021-39199.8A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege a CVE-2021-391905.3The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuratio CVE-2021-391916.1mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party,CVE-2021-391927.2Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows a CVE-2021-391935.3Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethe CVE-2021-391946.5kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could p CVE-2021-391956.5Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in CVE-2021-391966.5pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged CVE-2021-391978.8better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outs