# CVE-2026-73493: Http4s blaze-server unbounded WebSocket message aggregation

Source: https://junglewise.ai/threats/cve-2026-73493-http4s-blaze-server-unbounded-websocket-message-aggregation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73493 · Severity: high · CVSS 7.5 · Published 2026-08-12

Http4s blaze-server is a Scala HTTP server library used to build web services, including those that support WebSocket connections. An attacker can send a specially crafted WebSocket message with unlimited fragments to exhaust the server's heap memory, causing the JVM to crash and the service to become unavailable. This affects any application using Http4s for WebSocket endpoints without requiring authentication or special configuration.

Technologies: [org.http4s:http4s-blaze-server_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-blaze-server-2-13). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-73493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73493 being exploited in the wild.

**How severe is CVE-2026-73493?** High severity, with a CVSS score of 7.5, published 12 August 2026.

**Which products and versions are affected?** Http4s Blaze-Server prior to 0.23.18 and 1.0.0-M42; org.http4s:http4s-blaze-server_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.18; org.http4s:http4s-blaze-server_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.18; org.http4s:http4s-blaze-server_3 (Maven) ECOSYSTEM:introduced=1.0.0-M1,fixed=1.0.0-M42.

**Is there a fix for CVE-2026-73493?** Yes. org.http4s:http4s-blaze-server_2.12 (Maven): upgrade to 0.23.18 or later; org.http4s:http4s-blaze-server_2.13 (Maven): upgrade to 0.23.18 or later; org.http4s:http4s-blaze-server_3 (Maven): upgrade to 1.0.0-M42 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73493 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73493?** Check whether you run Http4s Blaze-Server, org.http4s:http4s-blaze-server_2.12 (Maven), org.http4s:http4s-blaze-server_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-blaze-server_2.12 (Maven): upgrade to 0.23.18 or later

  ```sh
  # set org.http4s:http4s-blaze-server_2.12 to 0.23.18 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-blaze-server_2.13 (Maven): upgrade to 0.23.18 or later

  ```sh
  # set org.http4s:http4s-blaze-server_2.13 to 0.23.18 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-blaze-server_3 (Maven): upgrade to 1.0.0-M42 or later

  ```sh
  # set org.http4s:http4s-blaze-server_3 to 1.0.0-M42 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is an unbounded resource exhaustion issue in the WebSocket frame aggregation logic (WSFrameAggregator). The server accumulates fragments of incoming WebSocket messages without enforcing a total size limit or fragment count cap; the existing maxWebSocketBufferSize setting only limits individual frame size, not aggregate message size. An attacker who completes a WebSocket handshake can send continuation frames with the FIN bit never set, forcing the server to buffer every fragment indefinitely until heap exhaustion triggers an OutOfMemoryError on the blaze selector thread. Small fragments amplify memory overhead through per-frame object allocation, so minimal wire traffic is sufficient to trigger denial of service. The issue is fixed in blaze-server versions 0.23.18 and 1.0.0-M42 by capping the aggregate WebSocket message size.

## Affected products

- Http4s blaze-server prior to 0.23.18 and 1.0.0-M42

## Identifiers

- CVE-2026-73493
- GHSA-7ppr-r889-mcf2

## Timeline

- 2026-08-12: disclosed: CVE-2026-73493 published
- 2026-07-23: patched: Fixed in blaze-server 0.23.18 and 1.0.0-M42

## References

- [https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471](https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471)
- [https://github.com/http4s/blaze/releases/tag/v0.23.18](https://github.com/http4s/blaze/releases/tag/v0.23.18)

## Related threats

- [http4s blaze HTTP/1.1 parser conformance bypass](https://junglewise.ai/threats/cve-2026-73494-http4s-blaze-http-1-1-parser-conformance-bypass)
- [Unbounded connection acceptance in http4s-blaze-server](https://junglewise.ai/threats/cve-2021-21294-unbounded-connection-acceptance-in-http4s-blaze-server)