CVE-2026-73495

Received Received - Intake

HTTP/1.1 Trailer Header Injection in Blaze

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73495

Affected Vendors & Products

Vendor	Product	Version / Range
blaze	blaze-server	to 1.0.0-M42 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects the blaze Scala library, specifically versions before 0.23.18 and 1.0.0-M42. It allows unauthenticated remote clients to inject arbitrary HTTP headers, including sensitive ones like X-Forwarded-For and internal authorization headers, by exploiting HTTP/1.1 chunked-body trailer fields. These trailers bypass header sanitization done by fronting proxies, enabling attackers to spoof client IP addresses, forge HTTPS schemes, or inject internal authorization headers.

Detection Guidance

To detect this vulnerability, check if your system uses blaze-server versions prior to 0.23.18 or 1.0.0-M42. Inspect HTTP/1.1 requests with chunked-body trailers for header injection. Monitor for unexpected headers like X-Forwarded-For or internal authorization headers in requests. Review proxy logs for forwarded chunked bodies with trailers intact.

Impact Analysis

If you use an http4s application with BlazeServerBuilder over HTTP/1.1 and trust proxy-set headers like X-Forwarded-For or X-Real-IP, this vulnerability could allow attackers to bypass trust decisions. They could spoof client IPs for allow-lists, rate limits, or auditing, forge HTTPS schemes, inject internal authorization headers, or even terminate backend connections prematurely by manipulating the Connection: close trailer.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized header injection, which may expose sensitive client IP addresses or internal authorization headers. Attackers could bypass proxy-based sanitization, potentially violating data protection requirements for user privacy and access controls.

Mitigation Strategies

Upgrade blaze-server to version 0.23.18 or 1.0.0-M42 or later to address the vulnerability. Review applications using BlazeServerBuilder over HTTP/1.1 to ensure they do not trust proxy-set headers if fronting proxies are not properly sanitizing them.

Hi! I’m here to help you understand CVE-2026-73495. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70