Default CORS config allows any origin with credentials

published 2021-09-01 5 y ago modified 2026-07-08 4 mo ago also GHSA-52cf-226f-rhr6 , EUVD-2021-1978

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Patch / fix

fixed in 3 links 2

maven org.http4s:http4s-server_3 0.22.3, 0.23.2
maven org.http4s:http4s-server_2.12 0.21.27, 0.22.3, 0.23.2
maven org.http4s:http4s-server_2.13 0.21.27, 0.22.3, 0.23.2

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.http4s:http4s-server_2.13.0-M5	all versions	no fix listed
maven	org.http4s:http4s-server_3	>=0.22.0, <0.22.3 >=0.23.0, <0.23.2	0.22.3 0.23.2
maven	org.http4s:http4s-server_2.10	all versions	no fix listed
maven	org.http4s:http4s-server_2.11	all versions	no fix listed
maven	org.http4s:http4s-server_2.12	<0.21.27 >=0.22.0, <0.22.3 >=0.23.0, <0.23.2	0.21.27 0.22.3 0.23.2
maven	org.http4s:http4s-server_2.13	<0.21.27 >=0.22.0, <0.22.3 >=0.23.0, <0.23.2	0.21.27 0.22.3 0.23.2

Affected products

http4s http4s

Classification

Weakness

CWE-346 Origin Validation Error

References

github.com /http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6
web, patch, third-party-advisory
github.com /http4s/http4s/releases/tag/v0.23.2
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-39185
advisory
github.com /http4s/http4s
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary