org.http4s:http4s-blaze-server_3 1.0.0-M34

Direct Vulnerabilities

Known vulnerabilities in the org.http4s:http4s-blaze-server_3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in request boundary parsing between the server and an intermediary. This is only exploitable if a fronting proxy or intermediary interprets HTTP request boundaries differently than the backend parser. How to fix HTTP Request Smuggling? Upgrade `org.http4s:http4s-blaze-server_3` to version 0.23.18, 1.0.0-M42 or higher.	[,0.23.18)[1.0.0-M22,1.0.0-M42)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service by sending a continuous stream of fragmented WebSocket messages that never complete, leading to unbounded heap growth and eventual server termination. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.http4s:http4s-blaze-server_3` to version 0.23.18, 1.0.0-M42 or higher.	[,0.23.18)[1.0.0-M22,1.0.0-M42)
C HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into `Request.headers`. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based trust decisions such as client IP allow-lists, rate-limits, audit logging, or internal authentication enforced by upstream proxies. This may allow spoofing of client identity or unauthorized access to protected resources. How to fix HTTP Request Smuggling? Upgrade `org.http4s:http4s-blaze-server_3` to version 0.23.18, 1.0.0-M42 or higher.	[,0.23.18)[1.0.0-M22,1.0.0-M42)

Vulnerability

Vulnerable Version

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in request boundary parsing between the server and an intermediary. This is only exploitable if a fronting proxy or intermediary interprets HTTP request boundaries differently than the backend parser.

How to fix HTTP Request Smuggling?

Upgrade org.http4s:http4s-blaze-server_3 to version 0.23.18, 1.0.0-M42 or higher.

[,0.23.18)[1.0.0-M22,1.0.0-M42)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service by sending a continuous stream of fragmented WebSocket messages that never complete, leading to unbounded heap growth and eventual server termination.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.http4s:http4s-blaze-server_3 to version 0.23.18, 1.0.0-M42 or higher.

[,0.23.18)[1.0.0-M22,1.0.0-M42)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based trust decisions such as client IP allow-lists, rate-limits, audit logging, or internal authentication enforced by upstream proxies. This may allow spoofing of client identity or unauthorized access to protected resources.

How to fix HTTP Request Smuggling?

Upgrade org.http4s:http4s-blaze-server_3 to version 0.23.18, 1.0.0-M42 or higher.

[,0.23.18)[1.0.0-M22,1.0.0-M42)

org.http4s:http4s-blaze-server_3@1.0.0-M34

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically