Vulnerability in Blaze Library Affects HTTP/1.1 Applications by HTTP Header Injection

CVE-2026-73495

What is CVE-2026-73495?

The Blaze library, utilized for creating asynchronous pipelines in Scala, is vulnerable due to improper handling of HTTP/1.1 chunked-body trailer fields. This flaw enables unauthorized remote clients to inject arbitrary header names and values, including sensitive headers like X-Forwarded-For and internal authorization headers, which can bypass established trust mechanisms in applications. Specifically, applications using BlazeServerBuilder over HTTP/1.1 that rely on proxy-set headers are particularly susceptible. Attackers can leverage this vulnerability to manipulate client identification for allow-lists or rate limits, forge the HTTPS scheme, and even control the termination of pooled backend connections. This issue was addressed in versions 0.23.18 and 1.0.0-M42.

References