Executive brief
A vulnerability in the blaze-server component of the http4s library allows attackers to bypass security controls set by front-end proxy servers. By injecting malicious data into specific parts of a web request, an attacker can trick the application into trusting fake identity or location information. This could lead to unauthorized access to internal features or the ability to bypass rate limits and IP-based security rules.
Technical details
The blaze-server implementation incorrectly merges HTTP/1.1 chunked-body trailer fields into the main Request.headers object. This behavior constitutes a form of HTTP Request Smuggling (CWE-444) where an attacker can provide headers in the trailer section that were previously stripped or sanitized by a fronting proxy (such as X-Forwarded-For or internal authentication headers). Because the application trusts these 'promoted' headers, an unauthenticated remote attacker can spoof client identities, bypass IP-based allow-lists, or forge internal authorization states. The vulnerability is exploitable when the application is deployed behind a proxy that forwards trailers but is relied upon for header-based security decisions. Patches are available in versions 0.23.18 and 1.0.0-M42.
Affected products
- http4s blaze-http_2.12 <= 0.23.17
- http4s blaze-http_2.13 <= 0.23.17, >= 1.0.0-M1, <= 1.0.0-M41
- http4s blaze-http_3 <= 0.23.17, >= 1.0.0-M1, < 1.0.0-M42
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory: GitHub Advisory GHSA-46q4-43ph-c6fr published