CVE-2026-73493

creationtimestamp| type| source ---|---|--- 2026-08-12 23:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mswackjquc27...

CVE-2026-73493

Summary: The CVE affects http4s-blaze-server in WebSocket handling where fragmented messages can be aggregated without an upper bound, causing unbounded heap growth and potential DoS via OutOfMemoryError on the Blaze server thread. Affected scope: any http4s application serving WebSocket routes o...

io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)

org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73493 Source advisory: MEND:CVE-2026-73493...

ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +130 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-m1, <=0.23.17)

org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-m1, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m2, =0.5.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2026-73493 Source advisory: MEND:CVE-2026-73493...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +146 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=0.23.17)

org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.30 and more Source cves: CVE-2026-73493 Source advisory: SNYK:JAVA-ORGHTTP4S-18313134...