org.http4s:http4s-blaze-server_2.11 (0.12.4), org.http4s:http4s-jetty_2.11 (0.12.4) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.4)

org.http4s:http4s-server2.11 MAVEN version 0.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.4 - org.http4s:http4s-jetty2.11 0.12.4 -...

org.http4s:http4s-blaze-server_2.11 (0.12.5), org.http4s:http4s-jetty_2.11 (0.12.5) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.5)

org.http4s:http4s-server2.11 MAVEN version 0.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.5 - org.http4s:http4s-jetty2.11 0.12.5 -...

org.http4s:http4s-blaze-server_2.11 (0.12.6), org.http4s:http4s-jetty_2.11 (0.12.6) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.12.6)

org.http4s:http4s-server2.11 MAVEN version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.12.6 - org.http4s:http4s-jetty2.11 0.12.6 -...

org.http4s:http4s-blaze-server_2.11 (0.20.5), org.http4s:http4s-jetty_2.11 (0.20.5) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.5)

org.http4s:http4s-server2.11 MAVEN version 0.20.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.5 - org.http4s:http4s-jetty2.11 0.20.5 -...

org.http4s:http4s-blaze-server_2.11 (0.20.10), org.http4s:http4s-jetty_2.11 (0.20.10) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.10)

org.http4s:http4s-server2.11 MAVEN version 0.20.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.10 - org.http4s:http4s-jetty2.11 0.20.10 -...

org.http4s:http4s-blaze-server_2.11 (0.20.13), org.http4s:http4s-jetty_2.11 (0.20.13) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.13)

org.http4s:http4s-server2.11 MAVEN version 0.20.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.13 - org.http4s:http4s-jetty2.11 0.20.13 -...

org.http4s:http4s-blaze-server_2.11 (0.20.20), org.http4s:http4s-jetty_2.11 (0.20.20) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.20)

org.http4s:http4s-server2.11 MAVEN version 0.20.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.20 - org.http4s:http4s-jetty2.11 0.20.20 -...

com.itv:scalapact-http4s-0-16-2_2.10 (>=2.2.0, <=2.2.1), org.http4s:http4s-blaze-server_2.10 (0.16.2) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.16.2)

org.http4s:http4s-server2.10 MAVEN version 0.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - com.itv:scalapact-http4s-0-16-22.10 =2.2.0, =2.2.1 - org.http4s:http4s-blaze-server2.10 0.16.2 -...

org.http4s:http4s-blaze-server_2.11 (0.20.9), org.http4s:http4s-jetty_2.11 (0.20.9) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.9)

org.http4s:http4s-server2.11 MAVEN version 0.20.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.9 - org.http4s:http4s-jetty2.11 0.20.9 -...

org.http4s:http4s-blaze-server_2.10 (0.16.0-rc3), org.http4s:http4s-jetty_2.10 (0.16.0-rc3) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.16.0-rc3)

org.http4s:http4s-server2.10 MAVEN version 0.16.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.16.0-rc3 - org.http4s:http4s-jetty2.10 0.16.0-rc3 -...

com.itv:scalapact-http4s-0-15-0a_2.11 (>=2.2.2, <=2.2.5), org.http4s:http4s-blaze-server_2.11 (0.15.16a) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.16a)

org.http4s:http4s-server2.11 MAVEN version 0.15.16a is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.itv:scalapact-http4s-0-15-0a2.11 =2.2.2, =2.2.5 - org.http4s:http4s-blaze-server2.11 0.15.16a -...

Design/Logic Flaw

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

Design/Logic Flaw

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

GHSA-XHV5-W9C5-2R2W Unbounded connection acceptance in http4s-blaze-server

Impact blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an...

GHSA-XMW9-Q7X9-J5QC Unbounded connection acceptance leads to file handle exhaustion

Impact All servers running blaze-core = 0.14.14, including blaze-http and http4s-blaze-server users, are affected. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request...

Unbounded connection acceptance leads to file handle exhaustion

Impact All servers running blaze-core = 0.14.14, including blaze-http and http4s-blaze-server users, are affected. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request...

CVE-2021-21294

The CVE-2021-21294 issue affects http4s-blaze-server (BlazeCore) where the server accepts connections unboundedly on its selector pool, potentially exhausting OS resources and undermining circuit breakers. Affected: http4s-blaze-server variants prior to 0.21.17, 0.22.0-M2, and 1.0.0-M14; underlyi...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.akolov:doorman-core_2.12 (0.0.5) +116 more potentially affected by CVE-2021-21294 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=0.21.16)

org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.13, =0.1.0.1 and more Source cves: CVE-2021-21294 Source advisory: MEND:CVE-2021-21294...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...