Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.http4s:http4s-blaze-server_2.13 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_2.13 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_3 | maven | <= 0.23.17 | 0.23.18 |
| org.http4s:blaze-http_3 | maven | >= 1.0.0-M1, <= 1.0.0-M41 | 1.0.0-M42 |
| org.http4s:blaze-http_2.13 | maven | >= 1.0.0-M1, <= 1.0.0-M41 | 1.0.0-M42 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from multiple HTTP/1.1 conformance laxities within the Blaze server's HTTP parser, making it susceptible to request smuggling attacks. The analysis of the patches reveals that the core issues were located in two key areas: the low-level header parser (BodyAndHeaderParser.parseHeaders) and the higher-level header validation logic (Http1ServerParser.headerComplete).
The BodyAndHeaderParser failed to enforce basic syntax rules, such as restricting header names to valid characters (tchar) and requiring headers to have values. The Http1ServerParser failed to enforce critical framing rules, such as rejecting requests that contained both Content-Length and Transfer-Encoding headers, had duplicate Content-Length headers, or used obsolete line folding.
An attacker could exploit these weaknesses by sending a specially crafted request that would be interpreted as a single, benign request by a front-end proxy but as two separate requests by the vulnerable Blaze backend. This allows the second, smuggled request to bypass proxy-level security controls (like authentication or filtering), leading to ACL bypass, cache poisoning, or response queue poisoning. The provided patches remediate these issues by adding strict validation at multiple stages of the parsing process to reject such malformed requests, as required by modern HTTP specifications.
org.http4s.blaze.server.Http1ServerParser.headerCompleteblaze-server/src/main/scala/org/http4s/blaze/server/Http1ServerParser.scala
org.http4s.blaze.http.parser.BodyAndHeaderParser.parseHeadershttp/src/main/java/org/http4s/blaze/http/parser/BodyAndHeaderParser.java