CVE-2026-73495
Full vulnerability record from the local CVENow database.
Description
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
View original CVE JSON
{
"id": "CVE-2026-73495",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T22:17:16.820",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
},
{
"lang": "es",
"value": "blaze es una biblioteca Scala para construir pipelines asíncronos, con un enfoque en la E/S de red. Antes de 0.23.18 y 1.0.0-M42, blaze-server puede fusionar campos de tráiler de cuerpo fragmentado HTTP/1.1 en Request.headers. Debido a que los campos de tráiler son controlados por el atacante, un cliente remoto no autenticado puede inyectar nombres y valores de encabezado arbitrarios, incluyendo X-Forwarded-For y encabezados de autorización internos, que un proxy frontal saneó de la sección de encabezados de la solicitud, eludiendo las decisiones de confianza basadas en encabezados en la aplicación. Cualquier aplicación http4s que use BlazeServerBuilder sobre HTTP/1.1 cuyas rutas o middleware confíen en encabezados establecidos por proxy, incluyendo X-Forwarded-For, X-Real-IP y X-Forwarded-Host, se ve afectada. Si un proxy frontal elimina o normaliza esos encabezados pero reenvía cuerpos fragmentados con tráilers intactos, un atacante puede suplantar la IP del cliente para listas de permitidos, límites de tasa o auditoría, falsificar el esquema HTTPS, o inyectar encabezados de autorización internos. Un tráiler Connection: close promovido también se respeta, permitiendo la terminación controlada por el atacante de conexiones de backend agrupadas. Este problema está solucionado en las versiones 0.23.18 y 1.0.0-M42."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "http4s",
"product": "blaze",
"versions": [
{
"version": "< 0.23.18",
"status": "affected"
},
{
"version": ">= 1.0.0-M1, < 1.0.0-M42",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T13:02:55.958244Z",
"id": "CVE-2026-73495",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-444"
}
]
}
],
"references": [
{
"url": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr",
"source": "[email protected]"
}
]
}