CVE-2026-73495

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73495", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.735Z", "datePublished": "2026-08-12T21:11:55.180Z", "dateUpdated": "2026-08-13T13:04:05.574Z"}, "containers": {"cna": {"title": "blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr"}, {"name": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f"}, {"name": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"}, {"name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"}], "affected": [{"vendor": "http4s", "product": "blaze", "versions": [{"version": "< 0.23.18", "status": "affected"}, {"version": ">= 1.0.0-M1, < 1.0.0-M42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:11:55.180Z"}, "descriptions": [{"lang": "en", "value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}], "source": {"advisory": "GHSA-46q4-43ph-c6fr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:02:55.958244Z", "id": "CVE-2026-73495", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:04:05.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)", "source": {"advisory": "GHSA-46q4-43ph-c6fr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "http4s", "product": "blaze", "versions": [{"status": "affected", "version": "< 0.23.18"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M42"}]}], "references": [{"url": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr", "name": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f", "name": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "name": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:11:55.180Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73495", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T13:02:55.958244Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-13T13:03:48.548Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-73495", "state": "PUBLISHED", "dateUpdated": "2026-08-12T21:11:55.180Z", "dateReserved": "2026-08-12T19:00:33.735Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T21:11:55.180Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "blaze", "vendor": "http4s", "versions": [{"status": "affected", "version": "< 0.23.18"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M42"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}, {"lang": "es", "value": "blaze es una biblioteca Scala para construir pipelines as\u00edncronos, con un enfoque en la E/S de red. Antes de 0.23.18 y 1.0.0-M42, blaze-server puede fusionar campos de tr\u00e1iler de cuerpo fragmentado HTTP/1.1 en Request.headers. Debido a que los campos de tr\u00e1iler son controlados por el atacante, un cliente remoto no autenticado puede inyectar nombres y valores de encabezado arbitrarios, incluyendo X-Forwarded-For y encabezados de autorizaci\u00f3n internos, que un proxy frontal sane\u00f3 de la secci\u00f3n de encabezados de la solicitud, eludiendo las decisiones de confianza basadas en encabezados en la aplicaci\u00f3n. Cualquier aplicaci\u00f3n http4s que use BlazeServerBuilder sobre HTTP/1.1 cuyas rutas o middleware conf\u00eden en encabezados establecidos por proxy, incluyendo X-Forwarded-For, X-Real-IP y X-Forwarded-Host, se ve afectada. Si un proxy frontal elimina o normaliza esos encabezados pero reenv\u00eda cuerpos fragmentados con tr\u00e1ilers intactos, un atacante puede suplantar la IP del cliente para listas de permitidos, l\u00edmites de tasa o auditor\u00eda, falsificar el esquema HTTPS, o inyectar encabezados de autorizaci\u00f3n internos. Un tr\u00e1iler Connection: close promovido tambi\u00e9n se respeta, permitiendo la terminaci\u00f3n controlada por el atacante de conexiones de backend agrupadas. Este problema est\u00e1 solucionado en las versiones 0.23.18 y 1.0.0-M42."}], "id": "CVE-2026-73495", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73495", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:02:55.958244Z", "version": "2.0.3"}}]}, "published": "2026-08-12T22:17:16.820", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.23.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0-M1,1.0.0-M42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "blaze", "source": "cna", "vendor": "http4s"}, "product": "blaze", "vendor": "http4s"}], "created": "2026-08-12T23:00:05.002136+00:00", "updated": "2026-08-13T02:15:02.665880+00:00", "vendors": ["http4s", "http4s$PRODUCT$blaze"]}