HTTP/1.1 Parser Vulnerabilities in Blaze Scala Library by HTTP4s

CVE-2026-73494

What is CVE-2026-73494?

The Blaze Scala library, utilized for building asynchronous pipelines focused on network IO, contains vulnerabilities linked to five HTTP/1.1 conformance relaxations in its Java parser. These flaws allow for the acceptance of invalid HTTP header field names, obsolete folded field lines, unsupported Transfer-Encoding values, and duplicate Content-Length headers. Such laxities can result in discrepancies between the parser within Blaze and a stricter intermediary, permitting a range of malicious exploits including front-end authorization bypass, response queue poisoning, and cache poisoning. Successful exploitation requires interaction between differing parsers without necessitating adjustments to Blaze's default configuration. This issue has been addressed in versions 0.23.18 and 1.0.0-M42.

References