StaticFile.fromUrl can leak presence of a directory

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS

• CVE-2021-32643: 1.40% estimated exploitation activity in the next 30 days; percentile 72.44 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns F[None], indicating no resource, if url.getFile is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23 0.22.0-M1 through 0.22.0-M8 0.23.0-M1 1.0.0-M1 through 1.0.0-M22 Patches The patch is available in the following versions: v0.21.24 v0.22.0-RC1 v0.23.0-RC1 v1.0.0-M23 Note: a previous version of this advisory incorrectly referred to 0.22.0-M9 and 0.23.0-M2. Workarounds Don't call StaticFile.fromUrl with non-file URLs. For more…

Published by the source

28 May 2021, 15:54 UTC

Last modified by the source

1 Feb 2023, 05:05 UTC

Source last checked

26 Oct 2026, 16:06 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-6h7w-fc84-x7p6

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2021-32643

Advisory: StaticFile.fromUrl can leak presence of a directory
IDs: CVE-2021-32643, GHSA-6h7w-fc84-x7p6
Record: https://patchnext.com/advisories/cve-2021-32643 (revision 1, source checked 26 Oct 2026, 16:06 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.http4s:http4s-core 1.0.0-M23, 0.23.0-RC1, 0.22.0-RC1, 0.21.24. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.http4s:http4s-core: affected >= 0.21.7, < 0.21.24; >= 0.22.0-M1, <= 0.22.0-M8; >= 0.23.0-M1, <= 0.23.0-M1; >= 1.0.0-M1, <= 1.0.0-M22; fixed in 0.22.0-RC1, 0.23.0-RC1, 1.0.0-M23, 0.21.24

## Suggested inspection (read-only)
- Maven org.http4s:http4s-core: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.http4s:http4s-core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-6h7w-fc84-x7p6 (GitHub-reviewed advisory GHSA-6h7w-fc84-x7p6 lists affected ranges: Maven org.http4s:http4s-core >=0.21.7 =0.22.0-M1 =0.23.0-M1 =1.0.0-M1 <=1.0.0-M22)

Commands are suggestions: review each one before running it.