Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

High 7.4

In plain English

A high-severity security flaw in blaze from http4s. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.6%top 49.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.http4s:blaze-http_2.130.23.18GHSA-mhvj-jhpq-885v
Mavenorg.http4s:blaze-http_2.131.0.0-M42GHSA-mhvj-jhpq-885v
Mavenorg.http4s:blaze-http_30.23.18GHSA-mhvj-jhpq-885v
Mavenorg.http4s:blaze-http_31.0.0-M42GHSA-mhvj-jhpq-885v
Mavenorg.http4s:http4s-blaze-server_2.130.23.18GHSA-mhvj-jhpq-885v

Affected products (as reported)

VendorProductVersions
http4s blaze < 0.23.18>= 1.0.0-M1, < 1.0.0-M42
org.http4s blaze-http_2.13 < 0.23.18>= 1.0.0-M1, < 1.0.0-M42
org.http4s blaze-http_3 < 0.23.18>= 1.0.0-M1, < 1.0.0-M42
org.http4s http4s-blaze-server_2.13 < 0.23.18

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References