http4s blaze HTTP request smuggling in Java wire parser

Executive brief

The Blaze HTTP library, used in Scala-based web services, contains flaws in how it processes web traffic. An attacker can exploit these flaws to 'smuggle' hidden requests past security filters, potentially bypassing access controls or poisoning web caches. This could lead to unauthorized access to sensitive data or the delivery of incorrect content to other users.

Technical details

The vulnerability consists of five independent HTTP/1.1 conformance laxities in Blaze's hand-written Java parser located in 'org.http4s.blaze.http.parser'. These flaws cause a disagreement in request boundaries between Blaze and a front-end proxy (CWE-444). An attacker can leverage this to perform request smuggling, leading to ACL bypass, response-queue poisoning, or cache poisoning. The issue is reachable via the default BlazeServerBuilder configuration. Patches are available in versions 0.23.18 and 1.0.0-M42.

Affected products

• http4s blaze-http_2.13 <= 0.23.17, >= 1.0.0-M1, <= 1.0.0-M41
• http4s blaze-http_3 <= 0.23.17, >= 1.0.0-M1, <= 1.0.0-M41
• http4s http4s-blaze-server_2.13 <= 0.23.17

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/ERobertGII
• https://github.com/ERobertGII
• https://api.github.com/users/ERobertGII/gists%7B/gist_id%7D
• https://api.github.com/users/ERobertGII/repos
• https://avatars.githubusercontent.com/u/93225934?v=4
• https://api.github.com/users/ERobertGII/events%7B/privacy%7D