blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

高 7.4CVE-2026-73494 · GHSA-mhvj-jhpq-885v · 14/09/2026 公開 · 30/09/2026 更新

要点

CVE-2026-73494 は org.http4s:blaze-http_2.13, org.http4s:blaze-http_3, org.http4s:http4s-blaze-server_2.13 に影響する深刻度「高」 (CVSS 7.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.1% より高い）。
対処：1.0.0-M42, 0.23.18 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.http4s:blaze-http_2.13 Maven	`≥ 1.0.0-M1, < 1.0.0-M42< 0.23.18`	`1.0.0-M420.23.18`
org.http4s:blaze-http_3 Maven	`≥ 1.0.0-M1, < 1.0.0-M42< 0.23.18`	`1.0.0-M420.23.18`
org.http4s:http4s-blaze-server_2.13 Maven	`< 0.23.18`	`0.23.18`

概要

Summary

Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (http/src/main/java/org/http4s/blaze/http/parser/) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration.

Impact

Actual exploitability depends on the fronting proxy — a boundary disagreement requires a pair of parsers that disagree. Where the proxy forwards the malformed bytes and derives a different message boundary, the consequences are the standard set: front-end ACL/auth bypass, response-queue poisoning on pooled backend connections, and cache poisoning. Risk concentrates on lenient or legacy intermediaries.

Workarounds

Deploy behind an RFC-strict reverse proxy (nginx, HAProxy, Envoy, ALB) that rejects or re-serializes malformed requests at the edge; this neutralizes most of these for deployments that cannot upgrade immediately.

NVD の説明

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.