{"id":"CVE-2026-73495","aliases":["EUVD-2026-57635","GHSA-46q4-43ph-c6fr"],"status":"published","title":"blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)","description":"blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0048,"percentile":0.41858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-07-24T22:26:48Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Maven","package":"org.http4s:blaze-http_2.13","fixed_in":["0.23.18","1.0.0-M42"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.http4s:blaze-http_2.12","fixed_in":["0.23.18"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.http4s:blaze-http_3","fixed_in":["0.23.18","1.0.0-M42"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:blaze-http_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.17"},{"fixed":"0.23.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:blaze-http_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.17"},{"fixed":"0.23.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:blaze-http_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.17"},{"fixed":"0.23.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:blaze-http_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M42"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:blaze-http_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"last_affected":"1.0.0-M41"},{"fixed":"1.0.0-M42"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:blaze-http_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.18"}]}],"versions":["0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.17","0.14.18","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.15.0","0.15.0-M1","0.15.0-M2","0.15.0-M3","0.15.1","0.15.2","0.15.3","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:blaze-http_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.18"}]}],"versions":["0.12.10","0.12.11","0.12.12","0.12.13","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.14.0","0.14.0-M1","0.14.0-M10","0.14.0-M11","0.14.0-M12","0.14.0-M2","0.14.0-M3","0.14.0-M4","0.14.0-M5","0.14.0-M6","0.14.0-M7","0.14.0-M8","0.14.0-M9","0.14.0-RC1","0.14.1","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.17","0.14.18","0.14.2","0.14.3","0.14.4","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.15.0","0.15.0-M1","0.15.0-M2","0.15.0-M3","0.15.1","0.15.2","0.15.3","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:blaze-http_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.18"}]}],"versions":["0.15.0","0.15.1","0.15.2","0.15.3","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:blaze-http_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M42"}]}],"versions":["1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M40","1.0.0-M41"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:blaze-http_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M42"}]}],"versions":["1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M40","1.0.0-M41"]}],"products":[{"vendor":"http4s","product":"blaze"}],"references":[{"url":"https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/http4s/blaze/releases/tag/v0.23.18","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/http4s/blaze/releases/tag/v1.0.0-M42","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-46q4-43ph-c6fr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73495.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73495","tags":["advisory"]},{"url":"https://github.com/http4s/blaze","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-73495","title":"blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)","description":"blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.","status":"published","published":"2026-08-12T21:11:55.18Z","modified":"2026-08-13T13:04:05.574Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-57635","description":"blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.","status":"published","published":"2026-08-12T21:11:55Z","modified":"2026-08-13T13:04:05Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-46q4-43ph-c6fr","title":"blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)","description":"### Summary\n  blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values (e.g. `X-Forwarded-For`, internal-auth headers) that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application.\n\n  ### Impact\n  Any http4s application using `BlazeServerBuilder` over HTTP/1.1 whose routes or middleware trust proxy-set headers (e.g., `X-Forwarded-For`, `X-Real-IP`, `X-Forwarded-Host`, org-internal auth headers) is affected. Where a fronting proxy strips/normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists/rate-limits/audit, forge the `https` scheme, or inject internal-auth headers. A promoted `Connection: close` trailer is also honored, allowing attacker-controlled termination of pooled backend connections.\n\n  ### Workarounds\n  Deploy behind a proxy that removes trailer fields (or rejects requests that use trailers) before forwarding; until patched, avoid trust decisions based on headers that a proxy is relied upon to sanitize.","status":"published","published":"2026-07-24T22:26:48Z","modified":"2026-08-12T21:12:01Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-73495","description":"blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.","status":"published","published":"2026-08-12T22:17:16.82Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-73495","title":"blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)","description":"blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.","status":"published","published":"2026-08-12T21:11:55.18Z","modified":"2026-10-28T02:30:31.686448798Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"GHSA-46q4-43ph-c6fr","title":"blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)","description":"### Summary\n  blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values (e.g. `X-Forwarded-For`, internal-auth headers) that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application.\n\n  ### Impact\n  Any http4s application using `BlazeServerBuilder` over HTTP/1.1 whose routes or middleware trust proxy-set headers (e.g., `X-Forwarded-For`, `X-Real-IP`, `X-Forwarded-Host`, org-internal auth headers) is affected. Where a fronting proxy strips/normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists/rate-limits/audit, forge the `https` scheme, or inject internal-auth headers. A promoted `Connection: close` trailer is also honored, allowing attacker-controlled termination of pooled backend connections.\n\n  ### Workarounds\n  Deploy behind a proxy that removes trailer fields (or rejects requests that use trailers) before forwarding; until patched, avoid trust decisions based on headers that a proxy is relied upon to sanitize.","status":"published","published":"2026-07-24T22:26:48Z","modified":"2026-08-12T21:25:59.135045Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:36.434231Z"}]}}