CVE-2026-69209: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

com.kubukoz:spotify-next_2.13 (>=1.3.0, <=1.3.5), dev.profunktor:http4s-jwt-auth_2.13 (>=1.0.0-rc1, <=1.0.0-rc3) +11 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_2.13 (>=1.0.0-m19, <=1.0.0-m36)

org.http4s:http4s-blaze-server2.13 MAVEN version =1.0.0-m19, =1.3.0, =1.0.0-rc1, =0.0.73, =0.1-a2fae94, =0.1-5acc59b, =0.12.0-rc1+85-6d61581e, =0.6.1, =0.14.5 - org.opentorah:opentorah-collector 0.2.6 - org.opentorah:opentorah-schedule 0.2.6 Source cves: CVE-2026-73494 Source advisory:...

io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)

org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822093...

io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)

org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822072...

ch.epfl.scala:cmt-core_3 (>=2.0.21, <=2.0.22), ch.epfl.scala:cmta_3 (>=2.0.21, <=2.0.22) +31 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_3 (>=0.22.0-rc1, <=0.23.17)

org.http4s:http4s-blaze-server3 MAVEN version =0.22.0-rc1, =2.0.21, =2.0.21, =2.0.21, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =1.1.1, =4.0.0-rc1, =4.0.0-rc1, =1.4.0, =2.0.0-rc13, =2.0.0-rc11, =2.0.19 and more Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822093...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/1.1 wire parser http/src/main/java/org/http4s/blaze/http/parser/, which carries five independent conformance laxities, notably in Content-Length handling relative to RFC 9110 section 8.6 and RFC 9112. ...

io.github.valdemargr:gql-http4s_2.13 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_2.13 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +3 more potentially affected by CVE-2026-73494 via org.http4s:blaze-http_2.13 (>=1.0.0-m33, <=1.0.0-m41)

org.http4s:blaze-http2.13 MAVEN version =1.0.0-m33, =0.1-a2fae94, =0.1-5acc59b, =1.0.0-m33, =1.0.0-m33, =1.0.0-m33, =1.0.0-m41 Source cves: CVE-2026-73494 Source advisory: MEND:CVE-2026-73494...

Denial-of-service (DoS)

Http4s http4s-blaze-server is vulnerable to a denial-of-service DoS. The vulnerability is due to the server aggregating incoming WebSocket message fragments without enforcing a limit on the total message size or fragment count, which allows an attacker to establish a WebSocket connection and...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493

Summary: The CVE affects http4s-blaze-server in WebSocket handling where fragmented messages can be aggregated without an upper bound, causing unbounded heap growth and potential DoS via OutOfMemoryError on the Blaze server thread. Affected scope: any http4s application serving WebSocket routes o...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)

org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73493 Source advisory: MEND:CVE-2026-73493...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493: Allocation of Resources Without Limits or Throttling

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

PT-2026-71347

Name of the Vulnerable Software and Affected Versions http4s-blaze-server versions prior to 0.23.18 http4s-blaze-server versions prior to 1.0.0-M42 Description The software aggregates fragments of incoming WebSocket messages without limiting the total size or the number of fragments. A client can...

com.kubukoz:spotify-next_2.13 (>=1.3.0, <=1.3.5), dev.profunktor:http4s-jwt-auth_2.13 (>=1.0.0-rc1, <=1.0.0-rc3) +11 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.13 (>=1.0.0-m19, <=1.0.0-m36)

org.http4s:http4s-blaze-server2.13 MAVEN version =1.0.0-m19, =1.3.0, =1.0.0-rc1, =0.0.73, =0.1-a2fae94, =0.1-5acc59b, =0.12.0-rc1+85-6d61581e, =0.6.1, =0.14.5 - org.opentorah:opentorah-collector 0.2.6 - org.opentorah:opentorah-schedule 0.2.6 Source cves: CVE-2026-73493 Source advisory:...

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

com.github.tototoshi:mvnsearch_2.13 (>=0.5.0, <=0.5.1), com.kubukoz:spotify-next_2.13 (>=1.3.0, <=1.3.5) +30 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-core_2.13 (>=1.0.0-m2, <=1.0.0-m41)

org.http4s:http4s-blaze-core2.13 MAVEN version =1.0.0-m2, =0.5.0, =1.3.0, =1.0.0-rc1, =0.0.73, =1.0.0, =0.1-a2fae94, =0.1-5acc59b, =0.12.0-rc1, =0.12.0-rc1, =0.12.0-rc1+85-6d61581e, =0.12.0-rc1+125-f68e01bd and more Source cves: CVE-2026-73493 Source advisory:...

io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)

org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73493 Source advisory: OSV:GHSA-7PPR-R889-MCF2...