http4s blaze vulnerabilities

Latest http4s blaze CVEs

Newest publication first

1. CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

   Published 2026-09-14

   High·CVSS 7.4 EPSS 0.63%

   blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze...

2. CVE-2026-73495 blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

   Published 2026-08-12

   High·CVSS 7.4 EPSS 0.48%

   blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote cl...

3. CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

   Published 2026-08-12

   High·CVSS 7.5 EPSS 0.63%

   Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket han...

4. CVE-2021-21293 Unbounded connection acceptance leads to file handle exhaustion

   Published 2021-02-02

   High·CVSS 7.5 EPSS 2.1%

   blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.