WebSocket Message Fragmentation Issue in Http4s Blaze Server
CVE-2026-73493
7.5HIGH
What is CVE-2026-73493?
The Http4s Blaze Server prior to version 0.23.18 and 1.0.0-M42 contains a vulnerability that allows an attacker to exploit the WebSocket protocol. Specifically, an unterminated fragmented message can be sent, leading to unbounded aggregation of message fragments and eventual denial of service due to heap exhaustion. This can occur without any special configuration, as the server treats all incoming frames without limiting size or count, resulting in an OutOfMemoryError when the server's heap is exhausted. The fixed versions address this issue by implementing limits on the total size of aggregated fragments.
Affected Version(s)
blaze < 0.23.18 < 0.23.18
blaze >= 1.0.0-M1, < 1.0.0-M42 < 1.0.0-M1, 1.0.0-M42