CVE-2026-73494
- Source
- https://cve.org/CVERecord?id=CVE-2026-73494
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73494.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73494
- Aliases
- Published
- 2026-09-14T17:33:49Z
- Modified
- 2026-10-02T08:13:33Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
- Details
-
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-444" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73494.json" }- References
-
- https://github.com/http4s/blaze/releases/tag/v0.23.18
- https://github.com/http4s/blaze/releases/tag/v1.0.0-M42
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73494.json
- https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v
- https://nvd.nist.gov/vuln/detail/CVE-2026-73494
- https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17
- https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96
- https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3
- https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734
- https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a
- https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6
Affected packages
Git / github.com/http4s/blaze
Affected ranges
- Type
- GIT
- Repo
- https://github.com/http4s/blaze
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "0.23.18" }, { "introduced": "1.0.0-M1" }, { "fixed": "1.0.0-M42" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v0.*
v1.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73494.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"40780726997125153208391369462960998917",
"242812349689475726822399330906770910858",
"70956982936300060267393980858160009430",
"111437233426961614431359773979922698748",
"251724075645085401740427755264252811359",
"165761697733828427217073585895701290717",
"308475171800077332652528308187325174200"
],
"threshold": 0.9
},
"id": "CVE-2026-73494-171b7cf9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a",
"target": {
"file": "http/src/main/java/org/http4s/blaze/http/parser/BodyAndHeaderParser.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "153646318109104197098759213324226770001",
"length": 2695
},
"id": "CVE-2026-73494-c18a7309",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a",
"target": {
"file": "http/src/main/java/org/http4s/blaze/http/parser/BodyAndHeaderParser.java",
"function": "parseHeaders"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11737987260535163784604846195929233277",
"219085939621185996103596451520496958704"
],
"threshold": 0.9
},
"id": "CVE-2026-73494-c7959143",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96",
"target": {
"file": "http/src/main/java/org/http4s/blaze/http/parser/HttpTokens.java"
}
}
]
vanir_signatures_modified
"2026-10-02T08:13:33Z"