Executive brief
http4s is a Scala web services framework that handles WebSocket connections. A flaw in its WebSocket decoder allows remote clients to exhaust server memory by sending oversized or fragmented messages without limits, causing service outages. This affects http4s-blaze-server and http4s-ember-server deployments exposed to untrusted network clients.
Technical details
The vulnerability is an unbounded resource consumption flaw in the WebSocket frame decoder. The root cause is twofold: the defragmentation logic accumulates message fragments without enforcing a size limit, and the FrameTranscoder accepts declared frame lengths up to Int.MaxValue. A remote attacker who completes a WebSocket handshake can send oversized frames or fragmented messages to trigger uncontrolled memory buffering. No authentication is required; the attack is triggered via network access to a WebSocket endpoint. The fix applies a configurable 64 MiB default limit per frame and defragmented message through EmberServerBuilder.withMaxWebSocketMessageSize, available in versions 0.23.35 and 1.0.0-M47.
Affected products
- http4s http4s-blaze-server prior to 0.23.35
- http4s http4s-ember-server prior to 0.23.35 and prior to 1.0.0-M47
Timeline
- 2026-09-15: disclosed: Public disclosure via NVD
- 2026-06-29: patched: Fix committed to http4s repository
- 2026-07-06: patched: Released in v0.23.35