CVE-2026-73494

The blaze Scala library, used as the default asynchronous HTTP server engine behind http4s BlazeServerBuilder, contains five HTTP/1.1 parsing laxities in its hand-written Java parser (BodyAndHeaderParser and Http1ServerParser) that let malformed requests through: invalid or valueless header field names violating tchar syntax, obsolete folded (obs-fold) header lines, unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests carrying both Transfer-Encoding and Content-Length. When a lenient or legacy fronting proxy forwards those malformed bytes but derives a different request boundary than blaze, the disagreement enables classic request smuggling with front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires no privileges and no non-default blaze configuration, but it does require an attacker to be positioned behind a disagreeing parser pair (e.g., a reverse proxy, CDN, or load balancer in front of a blaze-powered service), reflected in the CVSS 3.1 score of 7.4 with high attack complexity. All users of blaze prior to 0.23.18 and the 1.0.0-M1 through 1.0.0-M41 milestone line are affected; the issue is fixed in 0.23.18 and 1.0.0-M42. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade to blaze 0.23.18 (on the 0.23.x line) or 1.0.0-M42 (on the 1.0.0 milestone line) by bumping the http4s-blaze-server/http4s-blaze-client dependency, or migrate to a different server backend such as Ember or Jetty. Additionally, configure the fronting proxy/CDN to strictly reject or normalize ambiguous requests — duplicate Content-Length, combined Transfer-Encoding and Content-Length, unsupported Transfer-Encoding values, obs-fold header lines, and malformed header names — since exploitation requires a disagreeing parser pair. Review access logs on any blaze service sitting behind a proxy for smuggle-inducing request patterns and check whether cached or pooled responses could have been poisoned.