GHSA-46q4-43ph-c6fr blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

• Maven org.http4s:blaze-http_2.13: < 0.23.18 → fixed in 0.23.18 • Maven org.http4s:blaze-http_2.12: < 0.23.18 → fixed in 0.23.18 • Maven org.http4s:blaze-http_3: < 0.23.18 → fixed in 0.23.18 • Maven org.http4s:blaze-http_3: >= 1.0.0-M1, < 1.0.0-M42 → fixed in 1.0.0-M42 • Maven org.http4s:blaze-http_2.13: >= 1.0.0-M1, < 1.0.0-M42 → fixed in 1.0.0-M42

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values (e.g. `X-Forwarded-For`, internal-auth headers) that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. ### Impact Any http4s application using `BlazeServerBuilder` over HTTP/1.1 whose routes or middleware trust proxy-set headers (e.g., `X-Forwarded-For`, `X-Real-IP`, `X-Forwarded-Host`, org-internal auth headers) is affected. Where a fronting proxy strips/normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists/rate-limits/audit, forge the `https` scheme, or inject internal-auth headers. A promoted `Connection: close` trailer is also honored, allowing attacker-controlled termination of pooled backend connections. ### Workarounds Deploy behind a proxy that removes trailer fields (or rejects requests that use trailers) before forwarding; until patched, avoid trust decisions based on headers that a proxy is relied upon to sanitize.