Skip to content
Threat Feed
Subscribe

Tag

Http/1.1

1 brief RSS
high advisory

Multiple HTTP/1.1 Request Smuggling Primitives in Blaze Java Parser

Five independent HTTP/1.1 conformance laxities in Blaze's Java parser cause request-boundary disagreement with a stricter intermediary proxy, enabling front-end ACL/authentication bypass, response-queue poisoning on pooled backend connections, and cache poisoning in affected `http4s-blaze-server` and `blaze-http` components.

http4s-blaze-server_2.13 +2 request-smuggling http/1.1 java vulnerability
2t