CVE-2026-73495: 
Java vulnerability analysis and mitigation

CVE-2026-73495 is a header injection / HTTP request smuggling vulnerability in blaze-server, a Scala library (part of the http4s ecosystem) for building asynchronous network pipelines. Prior to versions 0.23.18 and 1.0.0-M42, blaze-server incorrectly merges HTTP/1.1 chunked-body trailer fields into Request.headers, allowing an unauthenticated remote attacker to inject arbitrary header names and values that a fronting proxy had already sanitized. Affected Maven artifacts include org.http4s:blaze-http_2.12, org.http4s:blaze-http_2.13, and org.http4s:blaze-http_3 at versions ≤ 0.23.17 and ≥ 1.0.0-M1 through ≤ 1.0.0-M41. The advisory was published on July 23, 2026, and assigned a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). In the vulnerable Http1ServerParser, both regular request headers and chunked-body trailer fields were appended to the same ListBuffer[Header.ToRaw], meaning trailer fields received after the body were indistinguishable from headers set by the proxy. The fix (commit ef3e666) routes trailer fields to a separate trailers buffer gated by an inChunkedHeaders() check, and latches the isChunkedMessage flag before parser state advances, ensuring trailers are never merged into Request.headers per RFC 9112 §7.1.2 (GitHub Advisory, Fix Commit). Exploitation requires the attacker to send a chunked HTTP/1.1 request with malicious trailer fields, and the deployment must sit behind a proxy that strips those headers from the request-header section but forwards chunked bodies with trailers intact.

Successful exploitation allows an unauthenticated remote attacker to bypass header-based trust decisions enforced by a fronting proxy. Concrete consequences include spoofing client IP addresses to circumvent IP allow-lists, rate limits, and audit logs (via injected X-Forwarded-For or X-Real-IP); forging the https scheme indicator (X-Forwarded-Proto); and injecting internal authorization headers to impersonate privileged internal services. Additionally, a promoted Connection: close trailer is honored by the server, enabling attacker-controlled termination of pooled backend connections, which can disrupt connection reuse and degrade availability (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is 0.0, indicating very low current exploitation probability (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific deployment topology — a fronting proxy that strips headers from the request-header section but forwards chunked bodies with trailers intact — which raises the effective attack complexity (reflected in the CVSS AC:H rating).

1. Reconnaissance: Identify http4s applications using BlazeServerBuilder over HTTP/1.1 that sit behind a proxy (e.g., nginx, HAProxy) configured to strip or normalize headers such as X-Forwarded-For, X-Real-IP, or internal authorization headers.
2. Craft chunked HTTP/1.1 request: Construct an HTTP/1.1 request using chunked transfer encoding (Transfer-Encoding: chunked) targeting any endpoint on the blaze-server.
3. Inject malicious trailer fields: Append the desired header(s) as trailer fields at the end of the chunked body. For example, to spoof a client IP:

POST /api/resource HTTP/1.1
Host: target.example.com
Transfer-Encoding: chunked
Trailer: X-Forwarded-For

5
hello
0
X-Forwarded-For: 127.0.0.1

4. Bypass proxy sanitization: The fronting proxy strips X-Forwarded-For from the request-header section but forwards the chunked body (including trailers) intact to the backend blaze-server.
5. Exploit merged headers: The vulnerable blaze-server merges the trailer field into Request.headers, making the injected X-Forwarded-For: 127.0.0.1 visible to application routes and middleware as if it were a legitimate proxy-set header.
6. Achieve objective: Depending on application logic, the attacker can bypass IP allow-lists, evade rate limiting, forge scheme indicators, or inject internal authorization headers to escalate privileges or access restricted resources (GitHub Advisory, Fix Commit).

• Network: HTTP/1.1 requests with both a Trailer: header in the request-header section and trailer fields appended after the final zero-length chunk; unusual Transfer-Encoding: chunked requests to endpoints that do not normally receive chunked bodies.
• Logs: Application or access logs showing requests where X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or internal authorization headers appear to originate from trusted IPs (e.g., 127.0.0.1, internal RFC 1918 ranges) despite no corresponding proxy log entry setting those headers.
• Logs: Unexpected Connection: close behavior on pooled backend connections, particularly if connection pool churn increases without a corresponding increase in client traffic.
• Application Behavior: Authorization bypasses or rate-limit evasion events correlated with chunked-body requests, especially where the trusted IP or scheme value does not match the actual client IP recorded at the proxy layer.

Upgrade to blaze version 0.23.18 (stable) or 1.0.0-M42 (milestone) immediately, as these releases route trailer fields to a separate buffer and never merge them into Request.headers (v0.23.18 Release, v1.0.0-M42 Release). As a temporary workaround prior to patching, configure the fronting proxy to strip or reject all trailer fields from chunked requests before forwarding to the backend, or configure it to reject any requests that use HTTP/1.1 trailers entirely. Avoid making trust decisions based on headers that rely solely on proxy sanitization until the patch is applied (GitHub Advisory).

The advisory was authored and remediation-reviewed by rossabaker (Ross A. Baker), a core http4s maintainer, and the vulnerability was reported by ERobertGII (GitHub Advisory). The v0.23.18 and v1.0.0-M42 releases were described as "security hardening releases" with an explicit call to "upgrade as soon as possible," and they bundled fixes for three additional security advisories alongside CVE-2026-73495 (v0.23.18 Release). No significant broader media coverage or notable social media commentary has been identified beyond the official GitHub advisory and standard CVE aggregator pickups.