HIGHMaven →
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Affected packages
- org.http4s:blaze-http_2.12— before 0.23.18
- org.http4s:blaze-http_2.13— before 0.23.18
- org.http4s:blaze-http_3— before 0.23.18
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr
- https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f
- https://github.com/http4s/blaze
- https://github.com/http4s/blaze/releases/tag/v0.23.18
- https://github.com/http4s/blaze/releases/tag/v1.0.0-M42
Structured record: https://osv.dev/vulnerability/GHSA-46q4-43ph-c6fr
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta