CVE-2026-73495

Name of the Vulnerable Software and Affected Versions blaze versions prior to 0.23.18 blaze versions prior to 1.0.0-M42

Description In blaze-server, HTTP/1.1 chunked-body trailer fields can be merged into Request.headers. Since trailer fields are controlled by the user, an unauthenticated remote client can inject arbitrary header names and values, such as X-Forwarded-For and internal authorization headers. This allows an attacker to bypass header-based trust decisions if a fronting proxy has already sanitized these headers from the request-header section but forwards chunked bodies with trailers intact. This can lead to spoofing client IPs for auditing, rate limits, or allow-lists, forging the https scheme, or injecting internal authorization headers. Additionally, a promoted Connection: close trailer is honored, which enables the attacker to terminate pooled backend connections.

Recommendations Update to version 0.23.18. Update to version 1.0.0-M42.