High
Security advisory
Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-43795
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:03 UTC · Revision 1
Source evidence
Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.
osv:CVE-2021-43795
Complete source record
{
"id": "3babddcec5b13c1f4a19cb9c21be0d99f5eaa3e8b3564a286e121c58ba52ede8",
"url": "https://osv.dev/vulnerability/CVE-2021-43795",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-43795",
"summary": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.",
"evidence": "osv:CVE-2021-43795",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-43795",
"aliases": [
"CVE-2021-43795",
"GHSA-8fp4-rp6c-5gcv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/line/armeria",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "cc2e40bdd157d4956b4a6d535d5cf47b0b0b2e07"
},
{
"fixed": "e2697a575e9df6692b423e02d731f293c1313284"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.13.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e2697a575e9df6692b423e02d731f293c1313284"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"armeria-0.27.0.Final",
"armeria-0.26.1.Final",
"armeria-0.26.0.Final",
"armeria-0.25.0.Final",
"armeria-0.24.1.Final",
"armeria-0.24.0.Final",
"armeria-0.23.1.Final",
"armeria-0.23.0.Final",
"armeria-0.22.0.Final",
"armeria-0.21.6.Final",
"armeria-0.21.5.Final",
"armeria-0.21.4.Final",
"armeria-0.21.3.Final",
"armeria-0.21.2.Final",
"armeria-0.21.1.Final",
"armeria-0.21.0.Final",
"armeria-0.20.2.Final",
"armeria-0.20.1.Final",
"armeria-0.20.0.Final",
"armeria-0.19.0.Final",
"armeria-0.18.0.Final",
"armeria-0.17.0.Final",
"armeria-0.16.1.Final",
"armeria-0.16.0.Final",
"armeria-0.15.0.Final",
"armeria-0.14.0.Final",
"armeria-0.13.4.Final",
"armeria-0.13.3.Final",
"armeria-0.13.2.Final",
"armeria-0.13.1.Final",
"armeria-0.13.0.Final",
"armeria-0.12.2.Final",
"armeria-0.12.1.Final",
"armeria-0.12.0.Final",
"armeria-0.11.0.Final",
"armeria-0.10.0.Final",
"armeria-0.9.0.Final",
"armeria-0.8.0.Final",
"armeria-0.7.0.Final",
"armeria-0.6.4.Final",
"armeria-0.6.3.Final",
"armeria-0.6.2.Final",
"armeria-0.6.1.Final",
"armeria-0.6.0.Final",
"armeria-0.5.1.Final",
"armeria-0.5.0.Final",
"armeria-0.4.0.Final"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43795.json",
"vanir_signatures": [
{
"id": "CVE-2021-43795-02cd3059",
"digest": {
"length": 408,
"function_hash": "45744797094526150620320818341588997297"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "space"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-062894ec",
"digest": {
"length": 280,
"function_hash": "213863245449820570868295890048385846044"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "colon"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-0b97e92f",
"digest": {
"length": 86,
"function_hash": "157143689614157276247006327619596596929"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "relative"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-0ea25713",
"digest": {
"length": 434,
"function_hash": "148188730759399574325037680037015321270"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "plus"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-0f72f88f",
"digest": {
"length": 89,
"function_hash": "333696233603227957240548507555568255028"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "toString"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-17792a6e",
"digest": {
"length": 1039,
"function_hash": "283801921640076960878469020750545403655"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "encodeToPercents"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-207c2907",
"digest": {
"length": 908,
"function_hash": "20768747672732289241306465500725550046"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "doubleDots"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-2225575e",
"digest": {
"length": 467,
"function_hash": "109138332473090788481339768641854029396"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "appendOneByte"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-23fb3154",
"digest": {
"length": 572,
"function_hash": "306876596576687346086316831474153271802"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/server/RoutingResultTest.java",
"function": "routingResult"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-3cce4d1c",
"digest": {
"length": 606,
"function_hash": "330704026167348029352860301063751880443"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/ArmeriaHttpUtilTest.java",
"function": "testDecodePath"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-3d8daefb",
"digest": {
"length": 888,
"function_hash": "197449139499400458598296260144012047514"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/ArmeriaHttpUtil.java",
"function": "decodePath"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-5024a873",
"digest": {
"length": 696,
"function_hash": "116261148284029217701854415736421348115"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "shouldNotDecodeSlash"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-5426a302",
"digest": {
"length": 1710,
"function_hash": "331981549961144803765262184712971734187"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "controlChars"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-67e9a579",
"digest": {
"length": 430,
"function_hash": "49675721860612087910735244964139607108"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "semicolon"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-6b0d51d7",
"digest": {
"length": 366,
"function_hash": "242246779641125720088941457156184244321"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "pathContainsDoubleDots"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-701b2bc8",
"digest": {
"length": 326,
"function_hash": "149268110643823752673844448683298471074"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "encodedUnicode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-7db674df",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6721900303599371177522985168129705535",
"299323585765637834466468493998016792156",
"210890468728026438543392735258066857863",
"24809470502484874754299625520044374724",
"305818961195679907477669463653464751101",
"133733474094686584734994521176564592304",
"141739131040827434538642286676272899249",
"49462781916477261731333359775012961835",
"319275627035730187278968244172452784893"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/ArmeriaHttpUtil.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-7fdf7b08",
"digest": {
"length": 279,
"function_hash": "32851682567271396844535162089411999185"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "hexadecimal"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-823c4657",
"digest": {
"length": 705,
"function_hash": "251510941967847477483971837906651144573"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "consecutiveSlashes"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-8dd435dd",
"digest": {
"length": 446,
"function_hash": "150519515074298979835302582652352546644"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "ampersand"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-a0c271e9",
"digest": {
"length": 422,
"function_hash": "70594287398634898130711975240128074036"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "equal"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-a7c02d47",
"digest": {
"length": 209,
"function_hash": "117913650753607592601677439989033441342"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "percent"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-b20322a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"138253376927122349673761170238999653061",
"104498975064665235454344478785014430242",
"208354962589521024984812785965592416565",
"263893468856167183607304531329674180491",
"183338709479969065032702096462144239114",
"73773734432575676597737138175035095593",
"139375384649801374045663307414994191337",
"19935521660159972501913048876483162729",
"161965782493228861148913778096734567961",
"252153492562764127227236778761205223151",
"232995427968883306105782055829892945174",
"331565548672849471245599368899035086406",
"49321892476902653288158467985012394342",
"240036292967516525935346717152545189787",
"28278137103888649067752160974583279829",
"140381538668974899893500251986110624700",
"215241310645877739509491627080361288115",
"131609839385208728484854201736760704667",
"59509061872044668149280824359491665101",
"204466689753292189318706399145312741116",
"126949601902569752863005787372427626588",
"224144249910391330355968525744306011959",
"16311339642200984682070208271819728112",
"281921306418649841015396036363459507199",
"141724308166288255110229165471017392098",
"252380978133823969702641444629648262195",
"198783058414575559786710934980038776181",
"123545597272620634252765648139189015192",
"264147302996262596637169755695706996649",
"55507946234815870394151046227048091030",
"339546907827019494331197170864311030062",
"131674538290336914136226632363553873835",
"154002250522557367074714649830557104138",
"74424938382815017818412735747175377713",
"192805175298704178679293360004836774283",
"83286724819482838254125774516401767642",
"218523024459799531329577626372858727678",
"76914967840765457736032870207282731331",
"98174637351441217651228918034640318058",
"171091728709224997556040308973697913796",
"52229584054513937709291795620713305277",
"74424938382815017818412735747175377713",
"336131327299669681092799798938836035397",
"39095522592553355395284729120753334555",
"272904699111966849544612814238064749334",
"230765973305384850425782458895178449798",
"245502750275536357692785381609444164564",
"252335545620771703401531137641633196278",
"118844248281857658178267273182278640649",
"29379970776969350831017783362965427928",
"250319801622557222402196238715687497126",
"73600591727934103948695571619793281159",
"302448416683345386116317433051510491598",
"155135953067729476747174062532686095668",
"64101552213568400680474337847216767710",
"14937380716454601260042841172953216085",
"267031337266172777142162026014191963811",
"292537176151240552357685756038661381259",
"249813775216002012527556614616407622002",
"95576144080501385000824279073374722578",
"39791588672658957323839044507891938857",
"177994984686592861486431327545958889390",
"281951846004537381087279494440087352181",
"325545147032939167775491460403647488567",
"48577065639012778269082617506881299827",
"174238129725902076703547165341974037044",
"46585409887832489490215954509765750761",
"213086230723921041508236330766833004595",
"216594976834116383830369523946393239144",
"207065131693409211727384095974125342717",
"201635188719113997186625160574003735291",
"326872598714156146224185229367685235710",
"324770474088648570402930959721720848633",
"145262193193218990491698274755023909764",
"46610851595089931118496660948880895240",
"213086230723921041508236330766833004595",
"328790185875162166431835405877081151313",
"16241386195123854944324484931277499498",
"207775824343627352697453998835656027339",
"290092100540381056069416601153059650671",
"225708110334793236578549062118271907273",
"105451396534641409292354033575380747128",
"259579448729246607620316871552671193539",
"158372204506429287875978496971945549205",
"227701101984335314683643494764246681391",
"136007808019445396879205015198626649805",
"83704485316732590358047752377540940457",
"319096204998099246648947412402759215905",
"37734618180668500233217889105451923161",
"139102779896522905669057012945512422192",
"224716885000457225811835904348191894428",
"355656299317710516835726372939132631",
"161591187318304083117581179073848365290",
"181746075192013307408333550565787006201",
"71535192705727383282577182396856941039",
"25306088658865765229519798376572988000",
"20536620433389242101625009886539984248",
"119967007516064022536819559014613596537",
"18935746508522160622413984908877762442",
"283193884928667568854819181755487059022",
"209236365174217739156768468876197835214",
"214875748007871660661212011837439789754",
"235314614764218679052783182035738141770",
"87479873824871825673003480157487152145",
"232007343525061192733305624689203938923",
"263513251266595017318497024164519904921",
"206082534103727048836419047137969273429",
"339391033683173315010630529202470564858",
"310962757174974395828289374477975823629",
"164131744044711630751847496892016199260",
"253539028746994321822069210353452828050",
"241478786986009305542304188238852299857",
"191244665281309153652475075829032534704",
"286429254519157874411128786788204850508",
"271696489389784339249606737981712770413",
"98339624819808681222817061319996993808",
"11720047061569278226429087154946812253",
"165363146162226672101726349218276002895",
"248145060897453447088829322974121366532",
"293606956028384076933536268681049121718",
"54259134355022916919523154790695436777",
"44686233623183850987146896993507902576",
"220894690046909061786355691409014833359",
"154928011511856625180838009457007671550",
"127299528200934840172259490460876851579",
"270127179623231032278169878249529707465",
"43144720103167364424907935774442117747",
"194973876430347959069749961835881172252",
"109105138929330639073010637176304767771",
"197814971407279760137686573204225079096",
"224364864827366458224336985697465651018",
"119196814830413996024885758091593202093",
"310986043571754667345078320923755473068",
"146864221921082182120190185453093848716",
"53578133876147357222861926362121245431",
"229018161337003236927976402946515131152",
"183099669212408571736344954445422139100",
"298089257637697649460974234891132169631",
"80442980874335320514930442744560717785",
"31020984512677796656516088967178658223",
"119780932560859213298249055103322659479",
"95969800202316802533745142759127073760",
"285532416385744166999683710755318897404",
"204989157853616772368715035829438450191",
"149554123294867789151144354734227018066",
"33698297540872910865185120899485274031",
"153981179369627079113944488899413110526",
"244867908519673517528865430999228050527",
"91665337341580081393812271917683060734",
"280219074221075274766181580508471292307",
"322076168558922943911810762453655174642",
"148420098148475307608235443557740096105",
"214490440516644468592524283968619911558",
"201902254203654737039798307820196218964",
"74127820736815305250186518757086112310",
"188428274671479876186378639511037212109",
"174459546612154366054555247113033424455",
"298690986889795529528552978933917040513",
"78324901902218309267150436872192552114",
"312554770414634002040702596749766408686",
"46145851929825042434671043457868075795",
"45958852882509548713344367982115504856",
"27575654927578199964637999591997196865",
"308286348233406652099666969100621697918",
"241075354949260136362888394931172573529",
"114380271243371715621128820825879074571",
"226008085703535368337880167257356531869",
"58289781976326736646258245536377843806",
"333172294952347066005831447356427617555",
"35219610365453429163392336454402445130",
"69601183771433946618980867367385119544",
"305550507181514445960872246951432609565",
"239041299633469973708053153621404744025",
"88687270320591111577722474918726125479",
"141032923549217868373132455611159202517",
"192185795065161531217891605793282770014",
"116198372980883668246116671284535343291"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-b88f909c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159219130768749026449153517041598775679",
"17856706169670999448515275218124772963",
"311298212391358305743524782346035332523",
"140357780114698139898809179490296186776",
"13118312613164055623939631117350023701",
"127766135382087386728886383602229496748",
"203527423882731108669011542392047522064",
"230296584237305534434902601970743898321",
"252926131295089903514242795898315919976",
"119847368413111979212125435381105111322",
"260295981838353360106779095050435981363",
"328345664718043634781554392960151924795",
"244189485027891445312349268962655879148",
"218584210620619147362085293087522068283",
"283039850002811729381908423061874653340",
"8646511824933018141636460122491202643",
"182978098086070122440202110285597740419",
"282860278274702265356736666525817787599",
"103515398593955196483732622437767280448",
"125305601830267266684429526790277744659",
"144319574867553645032172905577605588550",
"301265055950313139930550268232190698177",
"71244563780626708705241815029973811605",
"254362515422482251510078925296787506980",
"115523314666629815222107777767750011808",
"315227178952721700861711630624197567238",
"74703585517791246156493320651677901551",
"115202770215355183891384713731169209509",
"4357119712543578915903149580951727144",
"241175136033056058893863248001338280828",
"109033417987579933370623495797780907852",
"17679786975412950103109164285915116164",
"146206540823648939277457212081902168308",
"80806817057363926142635734042579796953",
"31757652524991054671962801123903628888",
"183232651790455644900777721302542236270",
"170323999351637458703525694939431420856",
"242680230368143997364328326536102727601",
"20762420054642053517185083587845750500",
"224010538471887945658423329212199308514",
"120666929938488679337417582806586215872",
"284424567806787609837586083275367891581",
"248650257863371063468514588460339007428",
"138973105908928028423084085436826526298",
"5422389754456901773219231452004950072",
"72537894212031777125956110955284440032",
"267092352281045966828585834869757638358",
"299408232969353830116430113004673364834",
"162542270340602395844344988306511365484",
"93103041313625345472964151650757979700",
"4325609539989156633280687005325608179",
"138662221989962511214863174670796659296",
"80910247086064991411531457495594401978",
"54318067900787413957839021229268927921",
"250938236230517585737562198100113379673",
"137978327294507072452838963394736573231",
"134583145382693463991002477237795928156",
"274538097807509275751672433517040336426",
"310237976026836885028676195633188802597",
"141652273608356393715154128316712662073",
"281927755435753045938984025015964261951",
"187583942749312003472136000864351119885",
"79391572723315271144213662954420586392",
"207857727152993203058549843178650626749",
"299623092388256295864745433818057171094",
"84210005312587112863379713744091001521",
"164150292682016492964954208001939859087",
"106787882311299348726663367499378049201",
"172915401478832653110439638315528980200",
"243411607724311756538684346092368978464",
"122227037341957440390310953561701546440",
"148439282629604077999012767709098004315",
"66136161019898202318707448621600474552",
"8410825814886396348297753342188636769",
"183519986243942833658337027536185247070",
"95203815451881846168721764731905202891",
"236301967633705561749137158720246322991",
"78725016581306827715246264591207654500",
"307514740320176476533107276757324049152",
"99330333727570972239327042958082450886",
"136311304841395020455470422737887459919",
"204094659932242430759982547457677127548",
"307297613545608908291753993347456393837",
"32383307678880117318919203141981137416",
"172874867583113524796232014989346724891",
"93402002593555954802245835192842902624",
"79642559068826389892806908901850738958",
"234527963311457722309726222797217807526",
"243675317170229345902311208564310119421",
"85614559720362527192323679495919997913",
"213089304577258020855184647729000556861",
"59226919661378070260092073812515012966",
"163997106650984795271084810676078439652",
"54691015786089592120057509238195078045",
"166893533698466624437224304841044282934",
"245920891476864086045008158853987257405",
"232263862332784598958158128999238606704",
"119758296197412089749307849318955684303",
"213138703004328180758302834971276792286",
"100489769449878211588298512674408563985",
"12299332964856970283296714993470320271",
"43475285515642245023212472167021143839",
"187195232453260978140976263468314021367",
"115043169779566912110084491701528171110",
"225747129150448284128920646623279056683",
"179007580639612652802744164293638637748",
"151649486615259480743380799394503695375",
"54771828689776270308879312534475470885",
"163441852014454178776781385603469994514",
"233068905266264113715029489368653325356",
"145031811366517451595317159304539733710",
"307617293443159851362144258527792223236",
"277466714149917330100077589146969398755",
"85938498837460646124127094804758389231",
"139480665771670522288495950396491068558",
"283036653713681321387712790072922151816",
"274245314015296705010659493762312608544",
"50072179613290937018697815104794492520",
"229974258340916838604077609276032587393",
"15172518138617113963199246314473450194",
"58673113740394555806552678598378083480",
"186796788619468067009660199653818670027",
"102811739517033758803178953837637330552",
"192937234245358434341287619121564025826",
"292802026891397837687525132020285319502",
"151436663637050825689851294779076866234",
"48995221147303846238424087935979879451",
"198696534623570947986404698651093663456",
"6100829827873870472885441973847822021",
"283894987326490466050939303542532985246",
"32960580412565828914180031052205346246",
"171733847849025260503299153940160923634",
"249033463627083717716996492989197482729",
"264264148754904488497911872496792388185",
"98162832839644432288467921464206855661",
"278244567451264308590177564777676354770",
"17034434376233984472083948765817349357",
"58022311283489969692560612256808341379",
"213220106511781973525189792514616160696",
"337105820919928743817960316527712937361",
"301043209992210423411735598050246200726",
"196678225759749563271323893320506310872",
"188746416646547873299309608005045597646",
"161334499012542098804007695602303535099",
"163714675694975973510590137990552308037",
"258536808602569874584604330836480081802",
"42251639999383858535481579783015517381",
"28380369025244303552787402192379477444",
"41857805954205147617439120490147470484",
"266325826732544238682108264003873111311",
"134509197222385764527311268809727662695",
"52732537583718402130661387652863330573",
"73940505748792164645401398995438770848",
"136727215611984155135438479950380950037",
"67695172059994092039786598664794559601",
"72077551160405233859194094356808270820",
"303579756737423067688669140254555996699",
"163466956783226002092929256111491467507",
"54762003882812080398434929920799812853",
"102145125297334237968045472404539457213",
"74894462203116256001321371716663522774",
"175249690485600123507442892773320467044",
"68174833092164982963399972264978101602",
"182681078013311159389673540904911213901",
"120505571249462483763014951996103145880",
"16050074937581897557501087655443013159",
"287179818911388251681285665872610642476",
"216073368739576703954154994770453399575",
"27382988994046348425156645564375322623",
"307911643519313844950310430869718245266",
"187361270318357990141087223192659802947",
"127141415775194876176645814749617507137",
"329703670304163598386588010017903939528",
"283629114462984727668653354686608178354",
"61219733837923958998499660940849181570",
"124267426549224727735909292507615020252",
"307243611780337902019975634504528973654",
"156671184530277706767323176284274825142",
"71224608560888024955473003529945761683",
"329777989001271650188475961370288796795",
"53690279042482993670692990058946587916",
"170911094858126226662645025555798535051",
"56594699132938928769101722703862370798",
"228329321481003270251878420731837587394",
"329479352278946343345643822827571959228",
"79286631453071085652064935500860874479"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-bd40d2bc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"195158673323348847908645093149008979317",
"77725807648746893936421848997978068900",
"146171956630280040275208680425487594397",
"145899176416195791637040069332471615924",
"23706197450930530692713613928982767252",
"49323632343940199100198808047913216935",
"287702692892202430540940017794279705156",
"18817842517003715402520678227952969343",
"242712270685909371693764440111271686412",
"235933248341675068640279261122797625302",
"100044237519819410196466170967913865511",
"258085935795293243906370614653354412284",
"172335389520132216070198158552851717821",
"21018081229747681117404505713204772909",
"178948816352733473903222619341298889639",
"209902924671234094923647134240683269381",
"299782098942073760520331479822060862481",
"127115268932090668468356279022804065698",
"112159235061436695625462473108005334539",
"85401745792251476643604523548913116376"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/ArmeriaHttpUtilTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-c89b91c2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"298255554627254260167614449082441138668",
"71290295465768767158814475650828498555",
"16351890535625977223834717248329028794",
"222412605146316472086753284482300195844"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/server/RoutingResultBuilder.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-c8cdc65a",
"digest": {
"length": 215,
"function_hash": "292792625795243312000829809990435014392"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "noEncoding"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-ceeddb4c",
"digest": {
"length": 568,
"function_hash": "196799281532563094558101689332627232126"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "empty"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-d19d2c43",
"digest": {
"length": 439,
"function_hash": "141145349720330140151939665391384395540"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "rawUnicode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-d431f294",
"digest": {
"length": 3318,
"function_hash": "239716812948304557708584687012964582088"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "decodePercentsAndEncodeToUtf8"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-d6b5a1df",
"digest": {
"length": 657,
"function_hash": "326176213090924101400337300384067738754"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "allReservedCharacters"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-d89c7622",
"digest": {
"length": 688,
"function_hash": "196626132432741969696369767352596907756"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "splitPathAndQuery"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-ea2798d4",
"digest": {
"length": 125,
"function_hash": "276849226725221505050513190310608889350"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "ReservedChar"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-ee20bd1d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326807599939373820050553976860218714235",
"194744523913169401614614538536086046792",
"250989630496912340285372976882447936119",
"188416708719242596724683593394022996468",
"274976433652617401653983088192301264521",
"236627197927582142041623800127599474100",
"227447245388993994653765794930716308135",
"117851584633166684722497596826775806963",
"90679823889862283630655980798741806148"
]
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/server/RoutingResultTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-f4407692",
"digest": {
"length": 182,
"function_hash": "125872771328875079162419862328681678540"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java",
"function": "appendHexNibble"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-f6dc0233",
"digest": {
"length": 422,
"function_hash": "122089588195918450253517538841296674380"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "sharp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-43795-f91ff9f0",
"digest": {
"length": 217,
"function_hash": "131209784038060826126595231760996870551"
},
"source": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284",
"target": {
"file": "core/src/test/java/com/linecorp/armeria/internal/common/PathAndQueryTest.java",
"function": "doubleQuote"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:34:29Z"
}
}
],
"modified": "2026-10-20T14:34:29.819485945Z",
"provider": "osv",
"references": [
"https://github.com/line/armeria/pull/3855",
"https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv",
"https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-43795",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389724,
"published_at": "2021-12-02T18:15:08.267+00:00"
}