blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Timeline

1. Aug 12, 2026, 9:11 PM UTCCVE published
2. Aug 13, 2026, 1:02 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 13, 2026, 1:04 PM UTCRecord last updated

Affected versions

• http4s blaze

  fixed in 0.23.18; From 1.0.0-M1 · fixed in 1.0.0-M42

• org.http4s:blaze-http_2.13Maven

  fixed in 0.23.18

• org.http4s:blaze-http_2.12Maven

  fixed in 0.23.18

• org.http4s:blaze-http_3Maven

  fixed in 0.23.18

• org.http4s:blaze-http_3Maven

  From 1.0.0-M1 · fixed in 1.0.0-M42

• org.http4s:blaze-http_2.13Maven

  From 1.0.0-M1 · fixed in 1.0.0-M42

References 4