CVE-2026-73494

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73494

Published

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73494

Published

blaze

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "http4s",
                    "product": "blaze",
                    "versions": [
                        {
                            "version": "< 0.23.18",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0-M1, < 1.0.0-M42",
                            "status": "affected"
                        }
                    ]
                }

blaze-http_2.13

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "org.http4s",
                    "product": "blaze-http_2.13",
                    "versions": [
                        {
                            "version": "< 0.23.18",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0-M1, < 1.0.0-M42",
                            "status": "affected"
                        }
                    ]
                }

blaze-http_3

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "org.http4s",
                    "product": "blaze-http_3",
                    "versions": [
                        {
                            "version": "< 0.23.18",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0-M1, < 1.0.0-M42",
                            "status": "affected"
                        }
                    ]
                }

http4s-blaze-server_2.13

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "org.http4s",
                    "product": "http4s-blaze-server_2.13",
                    "versions": [
                        {
                            "version": "< 0.23.18",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON