Skip to content
Fencer Vulns
high 7.4

CVE-2026-73495 json

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

published 2026-07-24 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-57635 , GHSA-46q4-43ph-c6fr

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Patch / fix

  • maven org.http4s:blaze-http_2.13 0.23.18, 1.0.0-M42
  • maven org.http4s:blaze-http_2.12 0.23.18
  • maven org.http4s:blaze-http_3 0.23.18, 1.0.0-M42
  • org.http4s blaze-http_3 0.23.18, 1.0.0-m42
  • typelevel blaze 0.23.18, 1.0.0-m42
  • org.http4s blaze-http_2.13 0.23.18, 1.0.0-m42
  • org.http4s blaze-http_2.12 0.23.18

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.http4s:blaze-http_2.13
<0.23.18
>=1.0.0-M1, <1.0.0-M42
0.23.18
1.0.0-M42
maven org.http4s:blaze-http_2.12
<0.23.18
0.23.18
maven org.http4s:blaze-http_3
<0.23.18
>=1.0.0-M1, <1.0.0-M42
0.23.18
1.0.0-M42

Affected products

  • http4s blaze

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.