# CVE-2026-73494: http4s blaze HTTP/1.1 parser conformance bypass

Source: https://junglewise.ai/threats/cve-2026-73494-http4s-blaze-http-1-1-parser-conformance-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73494 · Severity: high · CVSS 7.4 · Published 2026-09-14

blaze is a Scala library for building asynchronous network applications. The HTTP/1.1 parser accepts malformed HTTP requests that violate standards, potentially allowing attackers to bypass authorization rules, poison response caches, or inject requests on pooled connections when used behind a stricter proxy or intermediary.

Technologies: [org.http4s:http4s-blaze-server_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-blaze-server-2-13). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-73494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73494 being exploited in the wild.

**How severe is CVE-2026-73494?** High severity, with a CVSS score of 7.4, published 14 September 2026.

**Which products and versions are affected?** Http4s Blaze < 0.23.18, 1.0.0-M1 through 1.0.0-M41; org.http4s:blaze-http_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.18; org.http4s:blaze-http_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.18; org.http4s:http4s-blaze-server_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.18.

**Is there a fix for CVE-2026-73494?** Yes. org.http4s:blaze-http_2.13 (Maven): upgrade to 0.23.18 or later; org.http4s:blaze-http_3 (Maven): upgrade to 0.23.18 or later; org.http4s:http4s-blaze-server_2.13 (Maven): upgrade to 0.23.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73494 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73494?** Check whether you run Http4s Blaze, org.http4s:blaze-http_2.13 (Maven), org.http4s:blaze-http_3 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:blaze-http_2.13 (Maven): upgrade to 0.23.18 or later

  ```sh
  # set org.http4s:blaze-http_2.13 to 0.23.18 in your pom.xml or build.gradle
  ```

- org.http4s:blaze-http_3 (Maven): upgrade to 0.23.18 or later

  ```sh
  # set org.http4s:blaze-http_3 to 0.23.18 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-blaze-server_2.13 (Maven): upgrade to 0.23.18 or later

  ```sh
  # set org.http4s:http4s-blaze-server_2.13 to 0.23.18 in your pom.xml or build.gradle
  ```


## Technical details

The hand-written Java parser in blaze (BodyAndHeaderParser and Http1ServerParser) implements five HTTP/1.1 parsing laxities: acceptance of invalid header field names violating tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests with both Transfer-Encoding and Content-Length. An attacker can exploit this by sending malformed requests that a lenient blaze parser accepts but a stricter upstream proxy rejects or interprets differently, leading to HTTP request smuggling, cache poisoning, or authorization bypass. The vulnerability requires a pair of disagreeing parsers (blaze and a stricter intermediary); no non-default configuration is needed to trigger it. Patches are available in versions 0.23.18 and 1.0.0-M42.

## Affected products

- http4s blaze < 0.23.18, 1.0.0-M1 through 1.0.0-M41

## Identifiers

- CVE-2026-73494
- GHSA-mhvj-jhpq-885v

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Versions 0.23.18 and 1.0.0-M42

## References

- [https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17](https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17)
- [https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96](https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96)

## Related threats

- [http4s blaze HTTP/1.1 trailer header injection](https://junglewise.ai/threats/cve-2026-73495-http4s-blaze-http-1-1-trailer-header-injection)
- [Http4s blaze-server unbounded WebSocket message aggregation](https://junglewise.ai/threats/cve-2026-73493-http4s-blaze-server-unbounded-websocket-message-aggregation)
- [Unbounded connection acceptance in http4s-blaze-server](https://junglewise.ai/threats/cve-2021-21294-unbounded-connection-acceptance-in-http4s-blaze-server)