Vulnerability GHSA-crq5-92j2-j7wv
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 hours ago
September 15, 2026 at 08:01 PM UTC
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
0.15.0 and 0.15.1 and 0.15.2 and 0.15.3 and 0.15.4 and 0.15.5 and 0.15.6 and 0.15.7 and 0.15.8 and 0.15.9 and 0.15.10 and 0.15.11 and 0.15.12 and 0.15.13 and 0.15.14 and 0.15.15 and 0.15.16 and 0.16.0 and 0.16.1 and 0.16.2 and 0.16.3 and 0.16.4 and 0.16.5 and 0.16.6 and 0.19.0
0.15.0 and 0.15.1 and 0.15.2 and 0.15.3 and 0.15.4 and 0.15.5 and 0.15.6 and 0.15.7 and 0.15.8 and 0.15.9 and 0.15.10 and 0.15.11 and 0.15.12 and 0.15.13 and 0.15.14 and 0.15.15 and 0.15.16 and 0.16.0 and 0.16.1 and 0.16.2 and 0.16.3 and 0.16.4 and 0.16.5 and 0.16.6 and 0.19.0
Summary
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
Details
The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.
On Windows, a similar attack exists with (%5C).
Impact
Disclosure of classpath or webjar resources outside the configured base.
Preconditions
- Application uses
ResourceService(with a non-root base path) orWebjarService - At least one classpath entry is served from a directory (e.g.
sbt run, exploded .war) - Backend forwards
%2F/%5Cwithout normalizing (e.g., Ember, Blaze)
Fixes
The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService.
FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.
Workarounds
- Deploy as a fat jar, with no filesystem directories on the classpath.
- Front the service with a proxy that rejects/normalizes
%2Fand%5Cin the request path.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 years ago
Response Splitting from unsanitized headers
==0.10.0, ==0.15.0, ==0.15.0a, ==0.15.1, ==0.15.10, ==0.15.10a, ==0.15.11, ==0.15.11a, ==0.15.12, ==0.15.12a, ==0.15.13, ==0.15.13a, ==0.15.14, ==0.15.14a, ==0.15.15, ==0.15.15a, ==0.15.16, ==0.15.16a, ==0.15.1a, ==0.15.2, ==0.15.2a, ==0.15.3, ==0.15.3a, ==0.15.4, ==0.15.4a, ==0.15.5, ==0.15.5a, ==0.15.6, ==0.15.6a, ==0.15.7, ==0.15.7a, ==0.15.8, ==0.15.8a, ==0.15.9, ==0.15.9a, ==0.16.0, ==0.16.0a, ==0.16.0a-M1, ==0.16.0a-M2, ==0.16.0a-M3, ==0.16.0a-RC1, ==0.16.0a-RC2, ==0.16.0a-RC3, ==0.16.1, ==0.16.1a, ==0.16.2, ==0.16.2a, ==0.16.3, ==0.16.3a, ==0.16.4, ==0.16.4a, ==0.16.5, ==0.16.5a, ==0.16.6, ==0.16.6a, >=0.17.0 <0.17.7, >=0.18.0 <0.18.27, ==0.19.0, >=0.20.0 <0.20.24, >=0.21.0 <0.21.10, >=0.21.11 <0.21.29, ==0.22-129-24d065b, ==0.22-143-49b5a8d, ==0.22-53-01128f5, ==0.22-96-55d3184, >=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
==0.10.0, ==0.15.0, ==0.15.0a, ==0.15.1, ==0.15.10, ==0.15.10a, ==0.15.11, ==0.15.11a, ==0.15.12, ==0.15.12a, ==0.15.13, ==0.15.13a, ==0.15.14, ==0.15.14a, ==0.15.15, ==0.15.15a, ==0.15.16, ==0.15.16a, ==0.15.1a, ==0.15.2, ==0.15.2a, ==0.15.3, ==0.15.3a, ==0.15.4, ==0.15.4a, ==0.15.5, ==0.15.5a, ==0.15.6, ==0.15.6a, ==0.15.7, ==0.15.7a, ==0.15.8, ==0.15.8a, ==0.15.9, ==0.15.9a, ==0.16.0, ==0.16.0a, ==0.16.0a-M1, ==0.16.0a-M2, ==0.16.0a-M3, ==0.16.0a-RC1, ==0.16.0a-RC2, ==0.16.0a-RC3, ==0.16.1, ==0.16.1a, ==0.16.2, ==0.16.2a, ==0.16.3, ==0.16.3a, ==0.16.4, ==0.16.4a, ==0.16.5, ==0.16.5a, ==0.16.6, ==0.16.6a, >=0.17.0 <0.17.7, >=0.18.0 <0.18.27, ==0.19.0, >=0.20.0 <0.20.24, >=0.21.0 <0.21.10, >=0.21.11 <0.21.29, ==0.22-129-24d065b, ==0.22-143-49b5a8d, ==0.22-53-01128f5, ==0.22-96-55d3184, >=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
High Risk
4 years ago
Response Splitting from unsanitized headers
==0.10.0, >=0.21.0 <0.21.10, >=0.21.11 <0.21.29, ==0.22-129-24d065b, ==0.22-143-49b5a8d, ==0.22-53-01128f5, ==0.22-96-55d3184, >=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
==0.10.0, >=0.21.0 <0.21.10, >=0.21.11 <0.21.29, ==0.22-129-24d065b, ==0.22-143-49b5a8d, ==0.22-53-01128f5, ==0.22-96-55d3184, >=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
High Risk
4 years ago
Response Splitting from unsanitized headers
>=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
>=0.22.0 <0.22.5, >=0.23.0 <0.23.4 GHSA-5vcm-3xc3-w7x3
Critical
5 years ago
Default CORS config allows any origin with credentials
0.23.0 - 0.23.1 GHSA-52cf-226f-rhr6
0.23.0 - 0.23.1 GHSA-52cf-226f-rhr6
Critical
5 years ago
Default CORS config allows any origin with credentials
0.23.0 - 0.23.1 GHSA-52cf-226f-rhr6
0.23.0 - 0.23.1 GHSA-52cf-226f-rhr6
Impacted packages
Timeline
Published
3 hours ago
September 15, 2026 at 08:01 PM UTC
Fixed (0.23.35)
Unknown
Unknown
Fixed (0.23.35)
Unknown
Unknown
Fixed (1.0.0-M47)
Unknown
Unknown
Fixed (0.23.35)
Unknown
Unknown
Fixed (1.0.0-M47)
Unknown
Unknown
Last Modified
2 hours ago
September 15, 2026 at 08:15 PM UTC