Vulnerability-Lookup

CVE-2026-73493 (GCVE-0-2026-73493)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:08 – Updated: 2026-08-13 17:53

Title

http4s-blaze-server: Unbounded WebSocket message aggregation

Summary

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 17:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/http4s/blaze/security/advisori…	x_refsource_CONFIRM
https://github.com/http4s/blaze/commit/173e8ca820…	x_refsource_MISC
https://github.com/http4s/blaze/releases/tag/v0.23.18	x_refsource_MISC
https://github.com/http4s/blaze/releases/tag/v1.0.0-M42	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
http4s	blaze	Affected: < 0.23.18 Affected: >= 1.0.0-M1, < 1.0.0-M42	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:49:17.058412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:53:19.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "blaze",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:08:34.981Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2"
        },
        {
          "name": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471"
        },
        {
          "name": "https://github.com/http4s/blaze/releases/tag/v0.23.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
        },
        {
          "name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
        }
      ],
      "source": {
        "advisory": "GHSA-7ppr-r889-mcf2",
        "discovery": "UNKNOWN"
      },
      "title": "http4s-blaze-server: Unbounded WebSocket message aggregation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73493",
    "datePublished": "2026-08-12T21:08:34.981Z",
    "dateReserved": "2026-08-12T19:00:33.735Z",
    "dateUpdated": "2026-08-13T17:53:19.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73493",
      "date": "2026-08-25",
      "epss": "0.00346",
      "percentile": "0.2716"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73493\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-12T22:17:16.673\",\"lastModified\":\"2026-08-13T18:18:17.740\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"http4s\",\"product\":\"blaze\",\"versions\":[{\"version\":\"\u003c 0.23.18\",\"status\":\"affected\"},{\"version\":\"\u003e= 1.0.0-M1, \u003c 1.0.0-M42\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-13T17:49:17.058412Z\",\"id\":\"CVE-2026-73493\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/http4s/blaze/releases/tag/v0.23.18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/http4s/blaze/releases/tag/v1.0.0-M42\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73493\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-13T17:49:17.058412Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-13T17:49:18.310Z\"}}], \"cna\": {\"title\": \"http4s-blaze-server: Unbounded WebSocket message aggregation\", \"source\": {\"advisory\": \"GHSA-7ppr-r889-mcf2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"http4s\", \"product\": \"blaze\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.23.18\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.0.0-M1, \u003c 1.0.0-M42\"}]}], \"references\": [{\"url\": \"https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2\", \"name\": \"https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471\", \"name\": \"https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/http4s/blaze/releases/tag/v0.23.18\", \"name\": \"https://github.com/http4s/blaze/releases/tag/v0.23.18\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/http4s/blaze/releases/tag/v1.0.0-M42\", \"name\": \"https://github.com/http4s/blaze/releases/tag/v1.0.0-M42\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-12T21:08:34.981Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73493\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T17:53:19.342Z\", \"dateReserved\": \"2026-08-12T19:00:33.735Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-12T21:08:34.981Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73493

Vulnerability from fkie_nvd - Published: 2026-08-12 22:17 - Updated: 2026-08-13 18:18

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471
	security-advisories@github.com	https://github.com/http4s/blaze/releases/tag/v0.23.18
	security-advisories@github.com	https://github.com/http4s/blaze/releases/tag/v1.0.0-M42
	security-advisories@github.com	https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "blaze",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
    }
  ],
  "id": "CVE-2026-73493",
  "lastModified": "2026-08-13T18:18:17.740",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73493",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-13T17:49:17.058412Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T22:17:16.673",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7PPR-R889-MCF2

Vulnerability from github – Published: 2026-07-24 22:28 – Updated: 2026-08-12 21:08

Summary

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Details

Summary

http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service via OutOfMemoryError.

Impact

Any http4s application serving WebSocket routes over BlazeServerBuilder is affected; no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate (it bounds only individual frames). A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. Where the WebSocket endpoint is reachable without authentication the attacker is unauthenticated and remote; where the handshake requires a principal, any authenticated client can still trigger it.

Workarounds

No blaze-server configuration bounds the aggregate; maxWebSocketBufferSize is not a mitigation.
Terminate/limit WebSocket traffic at a fronting layer that enforces message-size and fragment limits, or disable WebSocket routes.
Longer term: blaze is EOL upstream; plan migration to a maintained backend (e.g. ember).

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-blaze-server_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-blaze-server_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-M1"
            },
            {
              "fixed": "1.0.0-M42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-blaze-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-blaze-server_3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-M1"
            },
            {
              "fixed": "1.0.0-M42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:28:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`http4s-blaze-server` aggregates the fragments of an incoming WebSocket\nmessage with no limit on total size or fragment count. A client that\ncompletes a WebSocket handshake can send an unterminated fragmented\nmessage and drive unbounded heap growth in the server JVM, resulting in\ndenial of service via `OutOfMemoryError`.\n\n## Impact\n\nAny http4s application serving WebSocket routes over\n`BlazeServerBuilder` is affected; no non-default configuration is required,\nand `maxWebSocketBufferSize` does not bound the aggregate (it bounds only\nindividual frames). A single connection sending continuation frames that\nnever set FIN forces the server to buffer every fragment until the heap is\nexhausted, terminating the JVM with `OutOfMemoryError` on the blaze\nselector thread. Small fragments amplify the cost through per-frame object\noverhead, so a modest volume of wire bytes is sufficient. Where the\nWebSocket endpoint is reachable without authentication the attacker is\nunauthenticated and remote; where the handshake requires a principal, any\nauthenticated client can still trigger it.\n\n## Workarounds\n\n- No blaze-server configuration bounds the aggregate; `maxWebSocketBufferSize`\n  is not a mitigation.\n- Terminate/limit WebSocket traffic at a fronting layer that enforces\n  message-size and fragment limits, or disable WebSocket routes.\n- Longer term: blaze is EOL upstream; plan migration to a maintained\n  backend (e.g. ember).",
  "id": "GHSA-7ppr-r889-mcf2",
  "modified": "2026-08-12T21:08:44Z",
  "published": "2026-07-24T22:28:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/commit/2ae13a74d55209b6573d5228d1aa94f0361a75d0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/commit/fadbe6d0f7f59045425688d313c8d4804973d12f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/http4s/blaze"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "blaze: Unbounded WebSocket message aggregation in http4s-blaze-server"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73493 (GCVE-0-2026-73493)

FKIE_CVE-2026-73493

GHSA-7PPR-R889-MCF2

Summary

Impact

Workarounds

Tags

Sightings

Nomenclature