The blaze server component of the http4s Scala library improperly merges HTTP/1.1 chunked-body trailer fields into the request headers. Since trailer fields can be attacker-controlled, this enables an unauthenticated remote attacker to inject arbitrary headers, including sensitive ones like X-Forwarded-For and internal authorization headers. Applications trusting these headers for security decisions are vulnerable to spoofing client IP addresses, forging HTTPS schemes, bypassing allow-lists, rate limits, or auditing controls. Additionally, attackers can inject a Connection: close trailer to prematurely terminate pooled backend connections. The vulnerability affects blaze versions before 0.23.18 and exactly version 1.0.0-M42. The issue is addressed by updating to 0.23.18 or 1.0.0-M42.

An attacker can bypass header-based trust mechanisms by injecting arbitrary HTTP headers through chunked-body trailers, leading to spoofing of client IP addresses and internal authorization headers. This can undermine allow-lists, rate limiting, auditing, and potentially cause premature termination of backend connections. The vulnerability does not require authentication and affects any http4s application using BlazeServerBuilder over HTTP/1.1 that trusts proxy-set headers.

This vulnerability is fixed in blaze versions 0.23.18 and 1.0.0-M42. Users should upgrade to at least version 0.23.18 or 1.0.0-M42 to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.