CVE-2026-73495

If you run http4s with the blaze server behind any fronting proxy that forwards chunked transfer-encoded bodies, this vulnerability matters more than the CVSS score suggests. The issue is straightforward: http4s merges HTTP trailers into the headers namespace during parsing, and this merge happens after your proxy's sanitization layer. Headers like X-Forwarded-For that your middleware trusts for IP allow-listing or rate limiting can be silently injected via trailers — bypassing the proxy entirely because trailers arrive in the body channel, not the header channel your proxy sanitizes. The versions to check are anything before 0.23.18 on the 0.23.x line or before 1.0.0-M42 on the 1.x milestone line. If you're running an older release, upgrade. But the version check alone isn't sufficient — you need to understand your deployment topology. The attack surface only exists when: a fronting proxy forwards chunked bodies (not re-encoded), that proxy doesn't strip trailers, and your application reads Request.headers for security decisions without accounting for trailer-origin headers. If any of those conditions don't hold, you're not exposed. What's harder to assess is whether you have application code that legitimately depends on trailer forwarding — the fix resolves the merge behavior, which means trailers are no longer promoted to the header namespace. If you have middleware that expects trailer-origin headers in Request.headers, that behavior is now gone and you'll need to audit that code. The HTTP/1.1 compliance implications are real but likely acceptable for most applications: trailers aren't a common legitimate use case, and the risk of invisible header injection far outweighs the loss of that functionality. The connection-pool poisoning vector is worth单独的 attention. A Connection: close trailer can force premature connection termination in your backend pool, enabling denial-of-service at the infrastructure layer without hitting application-level rate limits. This shifts the severity from 'potential header spoofing' to 'potential infrastructure disruption' — check whether your connection pool management treats trailers as equivalent to headers for protocol-level state changes, because that's where the operational blast radius lives.

Reviewed through automated stages and approved by a human before publication.