Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.
On Windows, a similar attack exists with (%5C).
Impact
Disclosure of classpath or webjar resources outside the configured base.
Preconditions
- Application uses
ResourceService(with a non-root base path) orWebjarService - At least one classpath entry is served from a directory (e.g.
sbt run, exploded .war) - Backend forwards
%2F/%5Cwithout normalizing (e.g., Ember, Blaze)
Fixes
The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService.
FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.
Workarounds
- Deploy as a fat jar, with no filesystem directories on the classpath.
- Front the service with a proxy that rejects/normalizes
%2Fand%5Cin the request path.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4s:http4s-server_2.12 | < 0.23.35 | 0.23.35 |
| Java / Kotlin (Maven) | org.http4s:http4s-server_2.13 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| Java / Kotlin (Maven) | org.http4s:http4s-server_3 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- Java / Kotlin (Maven)
- Package
org.http4s:http4s-server_2.12, org.http4s:http4s-server_2.13, org.http4s:http4s-server_3- Disclosed
- 15.09.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-crq5-92j2-j7wv - CC BY 4.0
Vulnerability history: org.http4s:http4s-server_2.12
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 03.2020 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 1
Disclosures per year
- 2020: 1
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.