high · 7.4Jul 24, 2026

blaze-server HTTP/1.1 Chunked Trailer Header Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A flaw in http4s blaze-server lets an attacker inject arbitrary HTTP headers by placing them in chunked-body trailer fields, bypassing any header sanitization a front-end proxy already performed.

Packageorg.http4s:blaze-http_2.13
Ecosystemmaven
Affected<= 0.23.17
Fixed in0.23.18
blaze-server HTTP/1.1 Chunked Trailer Header Injection

The problem

blaze-server's HTTP/1.1 request parser appended chunked-body trailer fields directly into Request.headers without filtering. Because trailers are attacker-controlled body content, not request-header-section content, this let any unauthenticated client introduce arbitrary header names and values.

Applications that trust proxy-set headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or internal auth headers are the primary target. A fronting proxy that strips those headers from the request-header section cannot protect the application if blaze re-introduces attacker-supplied values from the trailer.

A promoted Connection: close trailer also lets the attacker forcibly drain backend connection pools.

Proof of concept

A working proof-of-concept for this issue in org.http4s:blaze-http_2.13, with the exact payload below.

http
POST /api/endpoint HTTP/1.1
Host: target.internal
Transfer-Encoding: chunked

5
hello
0
X-Forwarded-For: 127.0.0.1
X-Internal-Auth: trusted-token

The terminal chunk is 0\r\n, followed by trailer fields, followed by a final \r\n. blaze's pre-patch parser collected everything after that zero-length chunk and merged it into the live Request.headers map, giving trailers the same trust level as headers sent by a trusted proxy.

The fix in commit ef3e666 strips all trailer fields before constructing the Request object, so they never appear in Request.headers regardless of what the client sends. This is the correct read of RFC 7230 section 4.1.2, which states trailers must not include headers that affect message framing, routing, or authentication.

Root cause is CWE-444: Inconsistent Interpretation of HTTP Requests.

The fix

Upgrade to blaze 0.23.18 (series/0.23) or 1.0.0-M42 (series/1.0). The patch commit is ef3e666c146cfc16cb6603f1fc3c464daab4a24f. As a workaround on older versions, configure your front-end proxy to reject or strip requests that carry chunked trailer fields before forwarding.

Reporter not attributed.

References: [1][2][3][4][5]

Related research