CVE-2026-73494: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in http4s blaze
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
AI Analysis
Technical Summary
The blaze library's HTTP/1.1 parser in affected versions accepts invalid or malformed HTTP headers and transfer-encoding fields that violate HTTP specifications. This leniency causes blaze to interpret request boundaries differently than stricter intermediaries, enabling HTTP request/response smuggling attacks. Exploitation requires a pair of disagreeing parsers (e.g., a lenient proxy forwarding to blaze). The vulnerability affects the BodyAndHeaderParser and Http1ServerParser components. It is resolved in blaze versions 0.23.18 and 1.0.0-M42.
Potential Impact
Successful exploitation can lead to front-end authorization bypass, allowing unauthorized access. It can also cause response queue poisoning on pooled backend connections and cache poisoning, potentially leading to data leakage or manipulation. The CVSS 3.1 score of 7.4 reflects high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Upgrade to blaze versions 0.23.18 or later, or 1.0.0-M42 or later, where this vulnerability is fixed. No non-default configuration is required to exploit, so patching is the primary mitigation. There is no indication that temporary fixes or workarounds exist. Patch status is confirmed fixed in the specified versions.
CVE-2026-73494: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in http4s blaze
Description
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
CVSS v3.1
Score 7.4high
Affected software
http4s
blaze
org.http4s
blaze-http_2.13
org.http4s
blaze-http_3
org.http4s
http4s-blaze-server_2.13
pkg:github/http4s/blazeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The blaze library's HTTP/1.1 parser in affected versions accepts invalid or malformed HTTP headers and transfer-encoding fields that violate HTTP specifications. This leniency causes blaze to interpret request boundaries differently than stricter intermediaries, enabling HTTP request/response smuggling attacks. Exploitation requires a pair of disagreeing parsers (e.g., a lenient proxy forwarding to blaze). The vulnerability affects the BodyAndHeaderParser and Http1ServerParser components. It is resolved in blaze versions 0.23.18 and 1.0.0-M42.
Potential Impact
Successful exploitation can lead to front-end authorization bypass, allowing unauthorized access. It can also cause response queue poisoning on pooled backend connections and cache poisoning, potentially leading to data leakage or manipulation. The CVSS 3.1 score of 7.4 reflects high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Upgrade to blaze versions 0.23.18 or later, or 1.0.0-M42 or later, where this vulnerability is fixed. No non-default configuration is required to exploit, so patching is the primary mitigation. There is no indication that temporary fixes or workarounds exist. Patch status is confirmed fixed in the specified versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.735Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8337755bf5e2cf5641817
Added to database: 09/14/2026, 17:48:39 UTC
Last enriched: 09/14/2026, 18:01:41 UTC
Last updated: 09/15/2026, 03:22:04 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.