Blaze
Monthly
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. No public exploit has been identified at time of analysis, but exploitation is trivially low-complexity: a single connection sending a stream of continuation frames that never assert FIN is sufficient.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. No public exploit has been identified at time of analysis, but exploitation is trivially low-complexity: a single connection sending a stream of continuation frames that never assert FIN is sufficient.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.