Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-73494
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 6 days, 10 hours ago Activity log
  • Created suggestion
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Affected products

blaze
  • ==< 0.23.18
  • ==>= 1.0.0-M1, < 1.0.0-M42
blaze-http_3
  • ==< 0.23.18
  • ==>= 1.0.0-M1, < 1.0.0-M42
blaze-http_2.13
  • ==< 0.23.18
  • ==>= 1.0.0-M1, < 1.0.0-M42
http4s-blaze-server_2.13
  • ==< 0.23.18

Matching in nixpkgs

pkgs.blaze

High performance C++ math library

  • nixos-unstable -
    • nixos-unstable-small 3.8.2
  • nixos-26.05 -
    • nixos-26.05-small 3.8.2

pkgs.mblaze

Unix utilities for processing and interacting with mail messages which are stored in maildir folders

  • nixos-unstable -
    • nixos-unstable-small 1.4
  • nixos-26.05 -
    • nixos-26.05-small 1.4

pkgs.blazesym-c

C language bindings for the blazesym library

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 0.1.7

pkgs.backblaze-b2

Command-line tool for accessing the Backblaze B2 storage service

  • nixos-unstable -
    • nixos-unstable-small 4.7.1
  • nixos-26.05 -
    • nixos-26.05-small 4.6.0

Package maintainers