Skip to content
OpenAdvisories

Package · Maven

org.http4s:blaze-http_2.12

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.4
    CVE-2026-73495

    blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unau…

    http4s blaze org.http4s:blaze-http_2.13 org.http4s:blaze-http_3 Maven