CVE-2026-73493

Name of the Vulnerable Software and Affected Versions http4s-blaze-server versions prior to 0.23.18 http4s-blaze-server versions prior to 1.0.0-M42

Description The software aggregates fragments of incoming WebSocket messages without limiting the total size or the number of fragments. A client can send an unterminated fragmented message, causing unbounded heap growth in the server JVM. This leads to a denial of service via an OutOfMemoryError on the blaze selector thread. The maxWebSocketBufferSize setting does not prevent this because it only limits individual frames rather than the aggregate message. Small fragments increase the impact due to per-frame object overhead, allowing a small amount of data to exhaust the heap.

Recommendations Update to version 0.23.18 or later. Update to version 1.0.0-M42 or later.