CVE-2023-22465

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224665.4Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when co CVE-2023-224677.5Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the CVE-2023-224685.4Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests CVE-2023-224693.5Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getti CVE-2023-22475.3In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function CVE-2023-224706.5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2023-224714.3Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken acc CVE-2023-224728.8Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is poss CVE-2023-224732.1Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access t CVE-2023-224748.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header CVE-2023-224756.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2023-224764.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any log