http4s-blaze-server: Unbounded WebSocket message aggregation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | blaze | before 0.23.18; 1.0.0-M1 to before 1.0.0-M42 | 0.23.18, 1.0.0-M42 | Patch available | CNA |
| — | org.http4s:http4s-blaze-server_2.13 (Maven) | before 0.23.18 | 0.23.18 | Patch available | GHSA-7ppr-r889-mcf2 |
| — | org.http4s:http4s-blaze-server_2.13 (Maven) | 1.0.0-M1 to before 1.0.0-M42 | 1.0.0-M42 | Patch available | GHSA-7ppr-r889-mcf2 |
| — | org.http4s:http4s-blaze-server_2.12 (Maven) | before 0.23.18 | 0.23.18 | Patch available | GHSA-7ppr-r889-mcf2 |
| — | org.http4s:http4s-blaze-server_3 (Maven) | 1.0.0-M1 to before 1.0.0-M42 | 1.0.0-M42 | Patch available | GHSA-7ppr-r889-mcf2 |
- blaze Vendorhttp4s Affected before 0.23.18; 1.0.0-M1 to before 1.0.0-M42 Fixed in 0.23.18, 1.0.0-M42 Patch available CNA
- org.http4s:http4s-blaze-server_2.13 (Maven) Vendor— Affected before 0.23.18 Fixed in 0.23.18 Patch available GHSA-7ppr-r889-mcf2
- org.http4s:http4s-blaze-server_2.13 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M42 Fixed in 1.0.0-M42 Patch available GHSA-7ppr-r889-mcf2
- org.http4s:http4s-blaze-server_2.12 (Maven) Vendor— Affected before 0.23.18 Fixed in 0.23.18 Patch available GHSA-7ppr-r889-mcf2
- org.http4s:http4s-blaze-server_3 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M42 Fixed in 1.0.0-M42 Patch available GHSA-7ppr-r889-mcf2
Remediation
- Fix · CNA blaze (http4s) Fixed in 0.23.18, 1.0.0-M42
- Fix · GHSA-7ppr-r889-mcf2 org.http4s:http4s-blaze-server_2.13 (Maven) Fixed in 0.23.18 Advisory →
- Fix · GHSA-7ppr-r889-mcf2 org.http4s:http4s-blaze-server_2.13 (Maven) Fixed in 1.0.0-M42 Advisory →
- Fix · GHSA-7ppr-r889-mcf2 org.http4s:http4s-blaze-server_2.12 (Maven) Fixed in 0.23.18 Advisory →
- Fix · GHSA-7ppr-r889-mcf2 org.http4s:http4s-blaze-server_3 (Maven) Fixed in 1.0.0-M42 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73493
- 2026-10-03 Alias added: GHSA-7ppr-r889-mcf2
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
Other 7
- https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2
- https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471
- https://github.com/http4s/blaze/releases/tag/v0.23.18
- https://github.com/http4s/blaze/releases/tag/v1.0.0-M42
- https://github.com/http4s/blaze/commit/2ae13a74d55209b6573d5228d1aa94f0361a75d0
- https://github.com/http4s/blaze/commit/fadbe6d0f7f59045425688d313c8d4804973d12f
- https://github.com/http4s/blaze
More http4s vulnerabilities
- TI-2022-13223 mTLS client verification is skipped in fs2 on Node.js CVSS 3.1CRITICAL 9.8
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2022-06031 Hash collision in typelevel jawn CVSS 3.1HIGH 7.5
- TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
- TI-2026-44185 http4s-scala-xml has an XML External Entity (XXE) processing issue CVSS 3.1CRITICAL 9.3
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
Sources
- CVE-2026-73493 · CVE Program
- CVE-2026-73493 · NVD
- FIRST EPSS
- GHSA-7ppr-r889-mcf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences