{"id":"CVE-2023-22465","aliases":["GHSA-54w6-vxfh-fw7f"],"url":"https://o3.security/vulnerability/CVE-2023-22465","summary":"Http4s has fatal error parsing User-Agent and Server headers","details":"### Impact\n\nThe `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. \n\n#### v0.21.x\n\n```scala\nval unsafe: Option[`User-Agent`] = req.headers.get(`User-Agent`)\n```\n\n#### v0.22.x, v0.23.x, v1.x\n\n```scala\nval unsafe: Option[`User-Agent`] = req.headers.get[`User-Agent`]\nval alsoUnsafe: Option[`Server`] = req.headers.get[Server]\n```\n\n### Patches\n\nFixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38.\n\n### Workarounds\n\n#### Use the weakly typed header interface\n\n##### v0.21.x\n\n```scala\nval safe: Option[Header] = req.headers.get(\"User-Agent\".ci)\n// but don't do this\nval unsafe = header.map(_.parsed) \n```\n\n##### v0.22.x, v0.23.x, v1.x\n\n```scala\nval safe: Option[Header] = req.headers.get(ci\"User-Agent\")\n```","published":"2023-01-04T15:30:04.129Z","modified":"2026-10-28T02:30:45.865179468Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.13","fixedVersion":"0.21.34"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.13","fixedVersion":"0.22.15"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.13","fixedVersion":"0.23.17"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.13","fixedVersion":"1.0.0-M38"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.10","fixedVersion":null},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.11","fixedVersion":null},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.12","fixedVersion":"0.21.34"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.12","fixedVersion":"0.22.15"},{"ecosystem":"Maven","name":"org.http4s:http4s-core_2.12","fixedVersion":"0.23.17"},{"ecosystem":"Maven","name":"org.http4s:http4s-core","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22465.json"},{"type":"ADVISORY","url":"https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22465"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:45.865179468Z"}}