CVE-2026-73495: Blaze HTTP/1.1 Auth Bypass Vulnerability

CVE-2026-73495 Overview

CVE-2026-73495 is an HTTP request smuggling vulnerability [CWE-444] in the blaze Scala library, an asynchronous pipeline framework focused on network I/O. Prior to versions 0.23.18 and 1.0.0-M42, blaze-server merges HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values. This bypasses header-based trust decisions in applications sitting behind a fronting proxy that sanitizes request headers but forwards chunked bodies with trailers intact.

Critical Impact
Attackers can spoof X-Forwarded-For, X-Real-IP, and X-Forwarded-Host headers to bypass allow-lists, forge the HTTPS scheme, inject internal authorization headers, or terminate pooled backend connections via a promoted Connection: close trailer.

Affected Products

blaze (http4s) versions prior to 0.23.18
blaze (http4s) versions prior to 1.0.0-M42
Any http4s application using BlazeServerBuilder over HTTP/1.1 with proxy-header trust

Discovery Timeline

2026-08-12 - CVE-2026-73495 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73495

Vulnerability Analysis

The vulnerability stems from blaze-server treating HTTP/1.1 chunked trailer fields as equivalent to request headers. When a client sends a chunked request body followed by trailer headers, the server appends those trailer fields directly into the Request.headers collection exposed to the application layer. Downstream routes and middleware cannot distinguish between headers set by a trusted fronting proxy and headers injected by a remote attacker through the request body.

This behavior is classified under [CWE-444]: Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling). The core problem is that proxy sanitization operates on the header section only, while blaze's trailer handling reintroduces attacker-controlled fields after the proxy has completed its trust decisions.

Root Cause

The root cause lies in Http1ServerParser.scala, where a single headersListBuffer accumulated both request headers and chunked trailer fields. No separation existed between the two logical header sections defined by RFC 7230. The patch introduces a distinct trailers buffer and tracks isChunkedMessage state so trailer fields are routed away from Request.headers.

Attack Vector

An unauthenticated remote attacker sends an HTTP/1.1 request with Transfer-Encoding: chunked through a fronting proxy. The proxy strips or normalizes trust-related headers such as X-Forwarded-For and forwards the request. The attacker appends trailer fields after the terminating zero-length chunk, injecting the same header names. blaze-server merges these into Request.headers, and application middleware treats the spoofed values as proxy-set.

text

// Security patch: Http1ServerParser.scala
// Route chunked trailer fields to a separate buffer
   private var method: String = _
   private var minor: Int = -1
   private val headers = new ListBuffer[Header.ToRaw]
+  private val trailers = new ListBuffer[Header.ToRaw]
+  private var isChunkedMessage = false
 
   def minorVersion(): Int = minor
 
   def doParseRequestLine(buff: ByteBuffer): Boolean = parseRequestLine(buff)
 
-  def doParseHeaders(buff: ByteBuffer): Boolean = parseHeaders(buff)
+  def doParseHeaders(buff: ByteBuffer): Boolean = {
+    val done = parseHeaders(buff)
+    // Capture whether the message declared chunked transfer-coding before any
+    // body/trailer parsing may flip the underlying parser state to END.
+    if (done) isChunkedMessage = isChunked
+    done
+  }
 
   def doParseContent(buff: ByteBuffer): Option[ByteBuffer] = Option(parseContent(buff))

Source: GitHub Commit ef3e666

Detection Methods for CVE-2026-73495

Indicators of Compromise

Inbound HTTP/1.1 requests using Transfer-Encoding: chunked that contain trailer fields carrying trust-related header names such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or X-Forwarded-Proto.
Mismatches between proxy access logs and application-observed client IP addresses for the same request ID.
Unexpected Connection: close trailer fields resulting in premature termination of pooled backend connections.
Requests where authorization or session headers appear only after the chunked body terminator.

Detection Strategies

Compare header values recorded at the fronting proxy against values received by the http4s application for identical requests to detect divergence.
Inspect raw HTTP/1.1 traffic for trailer sections containing header names that policy assigns exclusively to the proxy tier.
Deploy WAF or reverse-proxy rules that reject requests with trailers containing sensitive header names.

Monitoring Recommendations

Log the full set of trailer field names on chunked requests reaching blaze-server instances for retrospective analysis.
Alert on authentication or authorization decisions granted to source IPs that do not appear in upstream proxy logs.
Track the version of blaze-server and http4s-blaze-server in software bill of materials data to identify unpatched deployments.

How to Mitigate CVE-2026-73495

Immediate Actions Required

Upgrade blaze-server to version 0.23.18 or 1.0.0-M42 immediately.
Audit all http4s middleware and routes that read X-Forwarded-For, X-Real-IP, X-Forwarded-Host, X-Forwarded-Proto, or custom internal authorization headers.
Rotate any credentials or session tokens that may have been exposed through spoofed authorization decisions.

Patch Information

The fix is available in blaze v0.23.18 and blaze v1.0.0-M42. Full technical details are documented in GitHub Security Advisory GHSA-46q4-43ph-c6fr. The patch routes chunked trailer fields into a separate trailers buffer, preventing them from contaminating Request.headers.

Workarounds

Configure the fronting proxy to reject or strip HTTP/1.1 requests containing trailer fields before they reach blaze-server.
Terminate HTTP/1.1 at the proxy and forward to blaze-server using a protocol or transport that does not preserve trailers.
Implement application-layer filters that discard header values matching trust-critical names when they arrive through unexpected code paths.

bash

# Example sbt dependency update
libraryDependencies += "org.http4s" %% "http4s-blaze-server" % "0.23.18"

# Or for the milestone line
libraryDependencies += "org.http4s" %% "http4s-blaze-server" % "1.0.0-M42"