CVE-2026-73494
Received Received - Intake

HTTP/1.1 Header Parsing Flaws in Blaze Scala Library

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-73494
EUVD
EUVD-2026-77697

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
http4s blaze to 0.23.18 (exc)
http4s blaze to 1.0.0-M42 (exc)
http4s blaze 0.23.18
http4s blaze 1.0.0-M42

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73494 is a vulnerability in the blaze HTTP/1.1 parser affecting Scala library versions prior to 0.23.18 and 1.0.0-M42. It involves five HTTP/1.1 conformance laxities in the hand-written Java parser that cause request-boundary disagreements with stricter intermediaries. These issues allow front-end authorization bypass, response-queue poisoning, or cache poisoning if a lenient proxy interprets malformed requests differently.

Detection Guidance

Detecting this vulnerability requires checking for malformed HTTP/1.1 requests that exploit header parsing laxities. Monitor server logs for 400 Bad Request responses indicating rejected headers due to invalid characters, duplicate Content-Length, obs-fold, unsupported Transfer-Encoding, or conflicting headers. Use tools like tcpdump or Wireshark to capture and analyze HTTP traffic for malformed requests.

Impact Analysis

This vulnerability can lead to front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a disagreeing parser pair, and no non-default configuration is needed. Attackers could manipulate requests to bypass security controls or inject malicious responses.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling front-end authorization bypass, response-queue poisoning, or cache poisoning. These issues may lead to unauthorized access to sensitive data or manipulation of responses, which are critical violations under both regulations. Strict adherence to HTTP/1.1 standards is required to prevent such security lapses.

Mitigation Strategies

Upgrade blaze to versions 0.23.18 or 1.0.0-M42 or later. Deploy an RFC-strict reverse proxy (e.g., nginx, HAProxy) in front of blaze servers to neutralize malformed requests. Monitor for 400 Bad Request errors and block suspicious traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart