The vulnerability allows an unauthenticated client to send HTTP/1.1 requests with chunked bodies that contain trailer fields. These trailer fields are merged into the request headers, letting the attacker inject arbitrary header names and values such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or internal authorization headers. Because front‑end proxies typically sanitize headers from the initial request line, the injected trailer headers bypass that sanitization and are treated as legitimate, leading to spoofed client IP addresses, forged HTTPS scheme, or elevated authorization. This flaw maps to CWE‑444 (Improper Handling of Mailer or Header Data). The attacker can also inject a Connection: close trailer to force backend connection termination. Affected systems The issue impacts all applications built with the http4s Blaze server library that are configured to accept HTTP/1.1 chunked transfer encoding before version 0.23.18 or 1.0.0‑M42. Users who trust proxy‑set headers or rely on front‑end header sanitization are vulnerable. The library versions prior to those releases will merge chunked‑body trailer fields into Request.headers. Risk and exploitability With a CVSS base score of 7.4 the flaw is considered high severity. The EPSS score is not available, but the vulnerability can be exercised by any remote client over HTTP/1.1 without authentication, making exploitation straightforward if an application accepts chunked bodies. The vulnerability is not listed in the CISA KEV catalog, yet its remote‑execution potential and ability to subvert security controls warrant immediate mitigation. The likely attack vector is a direct HTTP/1.1 request using chunked transfer encoding, exploiting the trailer field promotion mechanism.

All deployments using the http4s Blaze server library before version 0.23.18 or 1.0.0‑M42 are affected. This includes applications built with BlazeServerBuilder over HTTP/1.1 that trust proxy‑set headers such as X-Forwarded-For, X-Real-IP, or X-Forwarded-Host.

The CVSS base score indicates a high level of risk, and the lack of an EPSS score suggests unknown but potentially significant exploitation probability. Because the flaw can be triggered by any unauthenticated client using HTTP/1.1, attackers have unrestricted access to inject headers that can bypass front‑end sanitization. The vulnerability is not yet recorded in CISA’s KEV catalog, but the described impact would allow attackers to falsify IP addresses for admission control, alter scheme declarations, or inject authorization directives, which could lead to unauthorized access or denial of service.