CVE-2026-69209

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

CVE-2026-69209: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

com.kubukoz:spotify-next_2.13 (>=1.3.0, <=1.3.5), dev.profunktor:http4s-jwt-auth_2.13 (>=1.0.0-rc1, <=1.0.0-rc3) +14 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_2.13 (>=1.0.0-m19, <=1.0.0-m36)

org.http4s:http4s-blaze-server2.13 MAVEN version =1.0.0-m19, =1.3.0, =1.0.0-rc1, =0.0.73, =0.1-a2fae94, =0.1-5acc59b, =0.12.0-rc1+85-6d61581e, =0.6.1, =1.1.8, =1.1.8, =1.1.9 and more Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822088...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/1.1 wire parser http/src/main/java/org/http4s/blaze/http/parser/, which carries five independent conformance laxities, notably in Content-Length handling relative to RFC 9110 section 8.6 and RFC 9112. ...

ch.epfl.scala:cmt-core_3 (>=2.0.21, <=2.0.22), ch.epfl.scala:cmta_3 (>=2.0.21, <=2.0.22) +31 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_3 (>=0.22.0-rc1, <=0.23.17)

org.http4s:http4s-blaze-server3 MAVEN version =0.22.0-rc1, =2.0.21, =2.0.21, =2.0.21, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =1.1.1, =4.0.0-rc1, =4.0.0-rc1, =1.4.0, =2.0.0-rc13, =2.0.0-rc11, =2.0.19 and more Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822093...

Denial-of-service (DoS)

Http4s http4s-blaze-server is vulnerable to a denial-of-service DoS. The vulnerability is due to the server aggregating incoming WebSocket message fragments without enforcing a limit on the total message size or fragment count, which allows an attacker to establish a WebSocket connection and...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493

Summary: The CVE affects http4s-blaze-server in WebSocket handling where fragmented messages can be aggregated without an upper bound, causing unbounded heap growth and potential DoS via OutOfMemoryError on the Blaze server thread. Affected scope: any http4s application serving WebSocket routes o...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

PT-2026-71347

Name of the Vulnerable Software and Affected Versions http4s-blaze-server versions prior to 0.23.18 http4s-blaze-server versions prior to 1.0.0-M42 Description The software aggregates fragments of incoming WebSocket messages without limiting the total size or the number of fragments. A client can...

CVE-2026-73493: Allocation of Resources Without Limits or Throttling

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +130 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-m1, <=0.23.17)

org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-m1, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m2, =0.5.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2026-73493 Source advisory: GHSA-7PPR-R889-MCF2...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in...

PT-2026-67590

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

org.http4s:http4s-blaze-server_2.11 (0.15.14a), org.http4s:http4s-jetty_2.11 (0.15.14a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.14a)

org.http4s:http4s-server2.11 MAVEN version 0.15.14a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.14a - org.http4s:http4s-jetty2.11 0.15.14a -...