Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman_2.13 (>=0.2.0, <=0.4.0) +130 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-m1, <=0.23.17)

org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-m1, =0.3.0, =0.2.0, =0.18.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-m1, =0.0.6-m4, =0.0.6-m4, =0.5.0-m2, =0.5.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2026-73493 Source advisory: GHSA-7PPR-R889-MCF2...

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

GHSA-7PPR-R889-MCF2 blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

GHSA-46Q4-43PH-C6FR blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the Java HTTP parser process. An attacker can bypass access controls, poison backend response queues, or manipulate cache contents by sending specially crafted HTTP/1.1 requests that exploit discrepancies in...

PT-2026-67590

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

PT-2026-67583

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

org.http4s:http4s-blaze-server_2.10 (0.15.14a), org.http4s:http4s-jetty_2.10 (0.15.14a) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.15.14a)

org.http4s:http4s-server2.10 MAVEN version 0.15.14a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.15.14a - org.http4s:http4s-jetty2.10 0.15.14a -...

org.http4s:http4s-blaze-server_2.10 (0.16.0a-m2), org.http4s:http4s-jetty_2.10 (0.16.0a-m2) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.16.0a-m2)

org.http4s:http4s-server2.10 MAVEN version 0.16.0a-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.16.0a-m2 - org.http4s:http4s-jetty2.10 0.16.0a-m2 -...

org.http4s:http4s-blaze-server_2.11 (0.17.0-rc3), org.http4s:http4s-jetty_2.11 (0.17.0-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.17.0-rc3)

org.http4s:http4s-server2.11 MAVEN version 0.17.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.17.0-rc3 - org.http4s:http4s-jetty2.11 0.17.0-rc3 -...

org.http4s:http4s-blaze-server_2.10 (0.16.0-rc3), org.http4s:http4s-jetty_2.10 (0.16.0-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.16.0-rc3)

org.http4s:http4s-server2.10 MAVEN version 0.16.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.16.0-rc3 - org.http4s:http4s-jetty2.10 0.16.0-rc3 -...

org.http4s:http4s-blaze-server_2.10 (0.13.1a), org.http4s:http4s-jetty_2.10 (0.13.1a) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.13.1a)

org.http4s:http4s-server2.10 MAVEN version 0.13.1a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.13.1a - org.http4s:http4s-jetty2.10 0.13.1a -...

org.http4s:http4s-blaze-server_2.10 (0.13.3a), org.http4s:http4s-jetty_2.10 (0.13.3a) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.13.3a)

org.http4s:http4s-server2.10 MAVEN version 0.13.3a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.13.3a - org.http4s:http4s-jetty2.10 0.13.3a -...

org.http4s:http4s-blaze-server_2.11 (0.14.9a), org.http4s:http4s-jetty_2.11 (0.14.9a) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.14.9a)

org.http4s:http4s-server2.11 MAVEN version 0.14.9a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.14.9a - org.http4s:http4s-jetty2.11 0.14.9a -...

org.http4s:http4s-blaze-server_2.11 (0.15.3), org.http4s:http4s-jetty_2.11 (0.15.3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.3)

org.http4s:http4s-server2.11 MAVEN version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.3 - org.http4s:http4s-jetty2.11 0.15.3 -...