Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-73494
Published:September 14, 2026
Updated:September 22, 2026
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Affected Packages
https://github.com/http4s/blaze.git (GITHUB):
Affected version(s) >=v0.14.0 <v0.23.18
Fix Suggestion:
Update to version v0.23.18
https://github.com/http4s/blaze.git (GITHUB):
Affected version(s) >=v1.0.0-M33 <v1.0.0-M42
Fix Suggestion:
Update to version v1.0.0-M42
org.http4s:blaze-http_3 (JAVA):
Affected version(s) >=0.15.0 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:blaze-http_2.13 (JAVA):
Affected version(s) >=0.14.5 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:blaze-http_3 (JAVA):
Affected version(s) >=0.15.0 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:http4s-blaze-server_2.13 (JAVA):
Affected version(s) >=0.10.0-M10 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:blaze-http_2.13 (JAVA):
Affected version(s) >=0.14.5 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:http4s-blaze-server_2.13 (JAVA):
Affected version(s) >=0.10.0-M10 <0.23.18
Fix Suggestion:
Update to version 0.23.18
org.http4s:blaze-http_3 (JAVA):
Affected version(s) >=1.0.0-M33 <1.0.0-M42
Fix Suggestion:
Update to version 1.0.0-M42
org.http4s:blaze-http_2.13 (JAVA):
Affected version(s) >=1.0.0-M33 <1.0.0-M42
Fix Suggestion:
Update to version 1.0.0-M42
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS
Base Score:
0.37