Http4S Blaze Server 2 13
Monthly
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.