Executive brief
Http4s blaze-server is a Scala HTTP server library used to build web services, including those that support WebSocket connections. An attacker can send a specially crafted WebSocket message with unlimited fragments to exhaust the server's heap memory, causing the JVM to crash and the service to become unavailable. This affects any application using Http4s for WebSocket endpoints without requiring authentication or special configuration.
Technical details
The vulnerability is an unbounded resource exhaustion issue in the WebSocket frame aggregation logic (WSFrameAggregator). The server accumulates fragments of incoming WebSocket messages without enforcing a total size limit or fragment count cap; the existing maxWebSocketBufferSize setting only limits individual frame size, not aggregate message size. An attacker who completes a WebSocket handshake can send continuation frames with the FIN bit never set, forcing the server to buffer every fragment indefinitely until heap exhaustion triggers an OutOfMemoryError on the blaze selector thread. Small fragments amplify memory overhead through per-frame object allocation, so minimal wire traffic is sufficient to trigger denial of service. The issue is fixed in blaze-server versions 0.23.18 and 1.0.0-M42 by capping the aggregate WebSocket message size.
Affected products
- Http4s blaze-server prior to 0.23.18 and 1.0.0-M42
Timeline
- 2026-08-12: disclosed: CVE-2026-73493 published
- 2026-07-23: patched: Fixed in blaze-server 0.23.18 and 1.0.0-M42