Skip to content
Fencer Vulns
high 7.5

CVE-2026-73493 json

http4s-blaze-server: Unbounded WebSocket message aggregation

published 2026-07-24 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-57631 , GHSA-7ppr-r889-mcf2

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Patch / fix

  • maven org.http4s:http4s-blaze-server_2.13 0.23.18, 1.0.0-M42
  • maven org.http4s:http4s-blaze-server_2.12 0.23.18
  • maven org.http4s:http4s-blaze-server_3 1.0.0-M42
  • org.http4s http4s-blaze-server_3 0.23.18, 1.0.0-m42
  • typelevel blaze 0.23.18, 1.0.0-m42
  • org.http4s http4s-blaze-server_2.13 0.23.18, 1.0.0-m42
  • org.http4s http4s-blaze-server_2.12 0.23.18

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.http4s:http4s-blaze-server_2.13
<0.23.18
>=1.0.0-M1, <1.0.0-M42
0.23.18
1.0.0-M42
maven org.http4s:http4s-blaze-server_2.12
<0.23.18
0.23.18
maven org.http4s:http4s-blaze-server_3
>=1.0.0-M1, <1.0.0-M42
1.0.0-M42

Affected products

  • http4s blaze

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.