CVE-2023-22465: Http4s improperly parses User-Agent and Server headers

January 6, 2023 (updated December 11, 2025)

The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers.

References

github.com/advisories/GHSA-54w6-vxfh-fw7f
github.com/http4s/http4s
github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f
nvd.nist.gov/vuln/detail/CVE-2023-22465

Code Behaviors & Features

Detect and mitigate CVE-2023-22465 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →