CVE-2026-73493
Full vulnerability record from the local CVENow database.
Description
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
View original CVE JSON
{
"id": "CVE-2026-73493",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T22:17:16.673",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
},
{
"lang": "es",
"value": "Http4s (http4s-blaze-server) es una interfaz Scala mínima e idiomática para servicios HTTP. Antes de 0.23.18 y 1.0.0-M42, http4s-blaze-server agrega fragmentos de un mensaje WebSocket entrante sin límite en el tamaño total o el recuento de fragmentos. Un cliente que completa un handshake WebSocket puede enviar un mensaje fragmentado no terminado y provocar un crecimiento ilimitado del heap en la JVM del servidor, lo que resulta en una denegación de servicio a través de OutOfMemoryError. Cualquier aplicación http4s que sirva rutas WebSocket sobre BlazeServerBuilder se ve afectada, no se requiere ninguna configuración no predeterminada, y maxWebSocketBufferSize no limita el agregado porque solo limita los frames individuales. Una única conexión que envía frames de continuación que nunca establecen FIN fuerza al servidor a almacenar en búfer cada fragmento hasta que el heap se agota, terminando la JVM con OutOfMemoryError en el hilo selector de blaze. Los fragmentos pequeños amplifican el costo a través de la sobrecarga de objetos por frame, por lo que un volumen modesto de bytes en la red es suficiente. Este problema está solucionado en las versiones 0.23.18 y 1.0.0-M42."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "http4s",
"product": "blaze",
"versions": [
{
"version": "< 0.23.18",
"status": "affected"
},
{
"version": ">= 1.0.0-M1, < 1.0.0-M42",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T17:49:17.058412Z",
"id": "CVE-2026-73493",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"references": [
{
"url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42",
"source": "[email protected]"
},
{
"url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2",
"source": "[email protected]"
}
]
}