The blaze-server component of org.http4s (version <0.23.18) merges HTTP/1.1 chunked-body trailer fields into the Request.headers object. Since trailer fields are attacker-controlled, this behavior allows an unauthenticated remote client to inject arbitrary headers that a fronting proxy may have sanitized from the initial request headers. This bypasses header-based trust decisions in applications, affecting any http4s application using BlazeServerBuilder over HTTP/1.1 that relies on proxy-set headers for security decisions. The vulnerability can be exploited to spoof client IP addresses, forge HTTPS schemes, inject internal authentication headers, and prematurely close backend connections. No official patch or fix link is provided in the data, and the vulnerability is classified as high severity with CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Applications using vulnerable versions of blaze-server that trust proxy-set headers can have their security controls bypassed. Attackers can inject arbitrary headers to spoof client IPs, bypass allow-lists or rate limits, forge HTTPS scheme indicators, inject internal authentication headers, and cause premature termination of backend connections. This compromises confidentiality and integrity of the application’s trust decisions based on HTTP headers. Availability impact is not indicated.

No official patch or fix is currently confirmed. Until a patch is available, deploy the application behind a proxy that removes or rejects HTTP/1.1 chunked-body trailer fields before forwarding requests. Additionally, avoid making trust decisions based on headers that rely on proxy sanitization, such as X-Forwarded-For or internal authentication headers. Monitor vendor advisories for updates regarding official fixes.