High 7.4Published Sep 14, 2026

CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Updated under an hour ago (Oct 27, 2026, 11:10 PM ET)

Does this affect you?

It affects http4s blaze and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for http4s blaze

Exploited in the last 30 days

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-444
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

http4s blaze http4s:blaze (from the name)	before 0.23.18; from 1.0.0-M1, < 1.0.0-M42	CNA record
org.http4s blaze-http_2.13 org.http4s:blaze_http_2.13 (from the name)	before 0.23.18; from 1.0.0-M1, < 1.0.0-M42	CNA record
org.http4s blaze-http_3 org.http4s:blaze_http_3 (from the name)	before 0.23.18; from 1.0.0-M1, < 1.0.0-M42	CNA record
org.http4s http4s-blaze-server_2.13 org.http4s:http4s_blaze_server_2.13 (from the name)	before 0.23.18	CNA record

References

References

https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v	x-refsource-confirm
https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17	x-refsource-misc
https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96	x-refsource-misc
https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3	x-refsource-misc
https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734	x-refsource-misc
https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a	x-refsource-misc
https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6	x-refsource-misc
https://github.com/http4s/blaze/releases/tag/v0.23.18	x-refsource-misc
https://github.com/http4s/blaze/releases/tag/v1.0.0-M42	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.