{"action":"Upgrade org.http4s:blaze-http_2.13 to 0.23.18 (0.x) or 1.0.0-M42 (1.x) or later.","affected":[{"fixed":"0.23.18","introduced":"0"},{"fixed":"1.0.0-M42","introduced":"1.0.0-M1"}],"component":"org.http4s:blaze-http_2.13","cve_ids":["CVE-2026-73494"],"ecosystem":"Maven","epss":0.00628,"exploited":false,"fixed_versions":["0.23.18","1.0.0-M42"],"ghsa_id":"GHSA-mhvj-jhpq-885v","id":"tcs_01M5N956PXVAFS44J0XXM2465M","modified_at":"2026-08-12T21:25:59.355788Z","published_at":"2026-07-24T22:26:27Z","references":["https://osv.dev/vulnerability/GHSA-mhvj-jhpq-885v","https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v","https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17","https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96","https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3","https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734","https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a","https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6","https://github.com/http4s/blaze","https://github.com/http4s/blaze/releases/tag/v0.23.18","https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-mhvj-jhpq-885v#Maven/org.http4s:blaze-http_2.13","url":"https://osv.dev/vulnerability/GHSA-mhvj-jhpq-885v"}],"summary":"blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser"}