Skip to main content
VulnerabilityPublished 07/24/2026

Org.http4s:http4s blaze server 2.13: blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Affects org.http4s:http4s-blaze-server_2.13Source GCVE Database

CVSS 3.1 base score
7.4High
Patch
Available – fixed in 0.23.18, 1.0.0-M42
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

What to do

AI-suggested

A fix is available in versions 0.23.18 and later. Until upgrading, it is recommended to deploy the blaze server behind an RFC-compliant reverse proxy such as nginx, HAProxy, Envoy, or AWS ALB that rejects or re-serializes malformed HTTP requests at the edge. This approach neutralizes most of the vulnerabilities for deployments that cannot upgrade immediately.

Affected software

ProductAffectedFixed in
Mavenorg.http4s:http4s-blaze-server_2.13Affected
  • <0.23.18
Fixed in
  • 0.23.18
Mavenorg.http4s:blaze-http_2.13Affected
  • <0.23.18
Fixed in
  • 0.23.18
Mavenorg.http4s:blaze-http_3Affected
  • <0.23.18
Fixed in
  • 0.23.18
Mavenorg.http4s:blaze-http_3Affected
  • >=1.0.0-M1 <1.0.0-M42
Fixed in
  • 1.0.0-M42
Mavenorg.http4s:blaze-http_2.13Affected
  • >=1.0.0-M1 <1.0.0-M42
Fixed in
  • 1.0.0-M42

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Multiple HTTP/1.1 request-smuggling vulnerabilities exist in the blaze server's Java wire parser used by org.http4s:http4s-blaze-server_2.13. These parser laxities cause disagreement on request boundaries when paired with stricter intermediaries, potentially allowing bypass of front-end access controls, response queue poisoning, and cache poisoning. The vulnerabilities affect versions prior to 0.23.18. Exploitability depends on the presence of a fronting proxy that interprets requests differently. Deploying behind an RFC-compliant reverse proxy can mitigate the risk until an upgrade is possible.

Weaknesses

References