http4s blaze CVE-2026-73495

Exploitation requires all of the following conditions to hold simultaneously: (1) the application uses BlazeServerBuilder (not Ember, Jetty, or other http4s backends) over HTTP/1.1 - HTTP/2 is not affected because HTTP/2 uses a separate trailer mechanism; (2) the application or its middleware makes trust decisions based on proxy-set headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or internal authorization headers; (3) a fronting proxy is deployed that strips or normalizes those headers from the request-header section before forwarding but does not also strip or reject HTTP/1.1 chunked trailer fields - the proxy must forward the raw chunked body including trailers intact; (4) the attacker can send HTTP/1.1 chunked requests with a Trailer header directly to the proxy. The CVSS AC:H rating reflects these combined requirements. Applications directly exposed to the internet without a sanitizing proxy, or those that use no header-based trust logic, or those already behind a proxy that also filters trailers are not exploitable. The Connection:close trailer abuse additionally requires only that pooled HTTP connections exist between the proxy and the blaze-server backend.

The CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately captures the high exploit prerequisites: AC:H reflects the requirement for a specific proxy topology where the fronting proxy strips headers from the request-header section but passes chunked body trailers unfiltered to the backend - a condition that is non-trivial but plausible in real reverse-proxy configurations (Nginx, HAProxy, Cloudflare) depending on their chunked-trailer handling settings. PR:N is correct since the attack requires no authentication; the attacker supplies the malicious trailer in the HTTP request itself. The C:H and I:H ratings are justified because a successful bypass of IP-based allow-lists or internal authorization headers can yield full unauthorized access to protected resources. The A:N rating in the NVD vector understates the Connection:close trailer abuse vector, which can force termination of pooled backend connections; in practice this represents at least a low availability impact. No EPSS data was provided in the input; the vulnerability is not in the CISA KEV catalog and no public POC has been identified, suggesting exploitation has not been observed at scale. Real-world risk is concentrated in http4s/BlazeServerBuilder deployments that (a) run over HTTP/1.1, (b) sit behind a sanitizing proxy, and (c) implement header-based trust logic - all three conditions must hold simultaneously, which meaningfully limits the exploitable population despite the high CVSS score.

An attacker targeting an http4s application that uses X-Forwarded-For for IP-based rate limiting sends a crafted HTTP/1.1 POST request with Transfer-Encoding: chunked and a Trailer: X-Forwarded-For declaration; the fronting proxy strips the X-Forwarded-For header from the request header section as intended, but forwards the chunked body to blaze-server with the attacker's trailer X-Forwarded-For: 1.2.3.4 appended after the final chunk. blaze-server merges this trailer into Request.headers, and the application's rate-limiting middleware reads the spoofed IP as if it were proxy-validated, bypassing per-IP restrictions or audit logging. No public POC has been identified, but the attack is constructable from the advisory description alone.