Threats Tagged 'ghsa-46q4-43ph-c6fr'

A vulnerability in org.http4s blaze-server allows HTTP/1.1 chunked-body trailer fields to be merged into Request.headers. This enables an unauthenticated remote attacker to inject arbitrary HTTP headers that may bypass fronting proxy sanitization. Applications trusting proxy-set headers such as X-Forwarded-For or internal authentication headers are at risk of spoofing client IPs, forging HTTPS schemes, or injecting unauthorized headers. The vulnerability also allows attacker-controlled termination of pooled backend connections via a promoted Connection: close trailer. Workarounds include deploying behind proxies that remove or reject trailer fields and avoiding trust decisions based on proxy-sanitized headers until patched.