CVE-2021-32643

CVE-2021-32643 is a medium-severity vulnerability affecting Http4s versions 0.21.7 through 1.0.0-M22, where the StaticFile.fromUrl function can inadvertently leak the presence of directories on a server. An unauthenticated attacker can exploit this by sending specially crafted URLs, inferring directory existence from 404 responses without exposing directory contents. The CVSS score is 5.8 (MEDIUM) due to its network-based attack vector and low attack complexity, with a potential impact of low confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.