CVE-2026-73493

Received Received - Intake

WebSocket DoS via Unbounded Fragment Aggregation in http4s-blaze-server

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73493

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects Http4s's Blaze server implementation. It allows a client to send fragmented WebSocket messages without a size limit, causing the server to consume excessive heap memory by buffering all fragments until the JVM runs out of memory and crashes.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory usage on the server running http4s-blaze-server, particularly on the Blaze selector thread. Check for WebSocket connections with fragmented messages that never set the FIN flag. Use JVM monitoring tools like jstat, jcmd, or VisualVM to observe heap growth and thread states.

Impact Analysis

If exploited, this flaw can lead to denial of service by crashing the server with an OutOfMemoryError. Any application using BlazeServerBuilder with WebSocket routes is vulnerable, even with default settings, as the issue isn't mitigated by maxWebSocketBufferSize.

Mitigation Strategies

Immediately upgrade http4s-blaze-server to version 0.23.18 or 1.0.0-M42 or later. If upgrading is not possible, restrict WebSocket connections or disable WebSocket routes until the update is applied. Monitor network traffic for fragmented WebSocket messages and block suspicious connections.

Hi! I’m here to help you understand CVE-2026-73493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70