CVE-2026-73494

Description

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

References

• https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17
• https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96
• https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3
• https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734
• https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a