WebSocket Message Buffering Vulnerability in Http4s by Http4s
CVE-2026-69209
7.5HIGH
What is CVE-2026-69209?
Http4s, a Scala interface for HTTP services, has a vulnerability in its WebSocket decoder that allows for unbounded message buffering. This can lead to server memory exhaustion when a remote client connects to an http4s-blaze-server or http4s-ember-server endpoint and sends oversized frames or fragmented messages. The impact can be mitigated by applying a configurable limit to the size of individual frames and defragmented messages, which is included in versions 0.23.35 and 1.0.0-M47.
Affected Version(s)
http4s < 0.23.35 < 0.23.35
http4s >= 1.0.0-M1, < 1.0.0-M47 < 1.0.0-M1, 1.0.0-M47