com.akolov:doorman_2.13 (>=0.2.0 <=0.4.0), com.avast.grpc:grpc-json-bridge-http4s_2.13 (>=0.18.3 <=0.18.4) +56 more potentially affected by CVE-2021-21293 +1 more via org.http4s:http4s-blaze-server_2.13 (>=0.21.0-M1 <=0.21.16)

org.http4s:http4s-blaze-server2.13 MAVEN version =0.21.0-M1, =0.2.0, =0.18.3, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.0.7-M1, =0.0.7-M1, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.38, =0.0.42 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory: OSV:GHSA-XHV5-W9C5-2...

com.akolov:doorman-core_2.12 (=0.0.5), com.akolov:doorman_2.12 (>=0.3.0 <=0.4.0) +101 more potentially affected by CVE-2021-21293 +1 more via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a <=0.21.16)

org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.18.3, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.13, =0.0.13, =0.0.13, =0.0.13, =0.0.32, =0.0.13, =0.0.38, =0.0.42 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory: OSV:GHSA-XHV5-W9C5-2R2W...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0 <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (=0.0.7) +146 more potentially affected by CVE-2021-21293 +1 more via org.http4s:blaze-core_2.12 (>=0.12.4 <=0.14.14)

org.http4s:blaze-core2.12 MAVEN version =0.12.4, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.18.1, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.1.13, =0.5.6 - com.azavea.geotrellis:geotrellis-stac-example2.12 =4.3.0 and more Source cves: CVE-2021-21293, CVE-2021-21294 Source advisory:...

CVE-2021-21294

The CVE-2021-21294 issue affects http4s-blaze-server (BlazeCore) where the server accepts connections unboundedly on its selector pool, potentially exhausting OS resources and undermining circuit breakers. Affected: http4s-blaze-server variants prior to 0.21.17, 0.22.0-M2, and 1.0.0-M14; underlyi...

CVE-2021-21294 Unbounded connection acceptance in http4s-blaze-server

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...