EUVD-2026-57631
GHSA-7ppr-r889-mcf2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable WebSocket endpoint, no complexity or privileges needed for unauthenticated surfaces, and sole impact is complete availability loss via JVM crash.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 8 maven packages depend on org.http4s:http4s-blaze-server_2.12 (3 direct, 5 indirect)
Ecosystem-wide dependent count for version 0.23.18.
DescriptionCVE.org
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
AnalysisAI
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must be using BlazeServerBuilder and must expose at least one WebSocket route - no non-default configuration is required beyond this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the worst-case scenario where a WebSocket endpoint is publicly reachable without authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a publicly exposed blaze-based Scala API performs the WebSocket handshake against any WebSocket endpoint and then sends a stream of small continuation frames - for example, 64-byte frames - that never include the FIN bit, preventing the server from delivering a complete message. Because each frame is buffered and also incurs per-object JVM heap overhead, the server heap grows monotonically; depending on heap configuration, a few thousand to tens of thousands of such frames suffice to trigger OutOfMemoryError on the selector thread and crash the JVM process. … |
| Remediation | Upgrade to http4s-blaze-server version 0.23.18 (for the stable series) or 1.0.0-M42 (for the milestone series); release artifacts are available at https://github.com/http4s/blaze/releases/tag/v0.23.18 and https://github.com/http4s/blaze/releases/tag/v1.0.0-M42. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Scala applications using http4s-blaze-server and identify those exposing WebSocket functionality-assess criticality with application owners to prioritize response. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5)
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - incl
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today