EUVD-2026-57635
GHSA-46q4-43ph-c6fr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N and PR:N confirmed by trailer-based unauthenticated attack; AC:H for required proxy topology; A:L added over NVD's A:N to capture attacker-controlled backend connection termination via Connection:close trailer.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 12 maven packages depend on org.http4s:blaze-http_2.12 (1 direct, 11 indirect)
Ecosystem-wide dependent count for version 0.23.18.
DescriptionCVE.org
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
AnalysisAI
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to hold simultaneously: (1) the application uses BlazeServerBuilder (not Ember, Jetty, or other http4s backends) over HTTP/1.1 - HTTP/2 is not affected because HTTP/2 uses a separate trailer mechanism; (2) the application or its middleware makes trust decisions based on proxy-set headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or internal authorization headers; (3) a fronting proxy is deployed that strips or normalizes those headers from the request-header section before forwarding but does not also strip or reject HTTP/1.1 chunked trailer fields - the proxy must forward the raw chunked body including trailers intact; (4) the attacker can send HTTP/1.1 chunked requests with a Trailer header directly to the proxy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately captures the high exploit prerequisites: AC:H reflects the requirement for a specific proxy topology where the fronting proxy strips headers from the request-header section but passes chunked body trailers unfiltered to the backend - a condition that is non-trivial but plausible in real reverse-proxy configurations (Nginx, HAProxy, Cloudflare) depending on their chunked-trailer handling settings. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an http4s application that uses X-Forwarded-For for IP-based rate limiting sends a crafted HTTP/1.1 POST request with Transfer-Encoding: chunked and a Trailer: X-Forwarded-For declaration; the fronting proxy strips the X-Forwarded-For header from the request header section as intended, but forwards the chunked body to blaze-server with the attacker's trailer X-Forwarded-For: 1.2.3.4 appended after the final chunk. blaze-server merges this trailer into Request.headers, and the application's rate-limiting middleware reads the spoofed IP as if it were proxy-validated, bypassing per-IP restrictions or audit logging. … |
| Remediation | The primary fix is to upgrade blaze to version 0.23.18 (for stable series users) or 1.0.0-M42 (for milestone series users); both are confirmed released at the GitHub tags linked above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately (within 24 hours): Inventory all applications running http4s blaze-server and document their upstream proxy architecture, specifically whether proxies sanitize HTTP trailer headers in chunked transfers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5)
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today