Skip to content

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

High severity GitHub Reviewed Published Jul 23, 2026 in http4s/blaze • Updated Jul 24, 2026

Package

maven org.http4s:blaze-http_2.13 (Maven)

Affected versions

<= 0.23.17
>= 1.0.0-M1, <= 1.0.0-M41

Patched versions

0.23.18
1.0.0-M42
maven org.http4s:blaze-http_3 (Maven)
<= 0.23.17
>= 1.0.0-M1, <= 1.0.0-M41
0.23.18
1.0.0-M42
maven org.http4s:http4s-blaze-server_2.13 (Maven)
<= 0.23.17
0.23.18

Description

Summary

Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (http/src/main/java/org/http4s/blaze/http/parser/) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration.

Impact

Actual exploitability depends on the fronting proxy — a boundary disagreement requires a pair of parsers that disagree. Where the proxy forwards the malformed bytes and derives a different message boundary, the consequences are the standard set: front-end ACL/auth bypass, response-queue poisoning on pooled backend connections, and cache poisoning. Risk concentrates on lenient or legacy intermediaries.

Workarounds

Deploy behind an RFC-strict reverse proxy (nginx, HAProxy, Envoy, ALB) that rejects or re-serializes malformed requests at the edge; this neutralizes most of these for deployments that cannot upgrade immediately.

References

@rossabaker rossabaker published to http4s/blaze Jul 23, 2026
Published to the GitHub Advisory Database Jul 24, 2026
Reviewed Jul 24, 2026
Last updated Jul 24, 2026

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS score

Weaknesses

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-mhvj-jhpq-885v

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.