Junglewise Threat Intelligence

http4s blaze-server Denial of Service via Unbounded WebSocket Aggregation

Severity: high · CVSS 7.5 · Published 2026-07-24

Technologies: Http4s-Blaze-Server. Vendors: Http4s.

Executive brief

The http4s-blaze-server, a component used to handle web traffic in Scala applications, fails to limit the size of incoming WebSocket messages. An attacker can exploit this by sending a continuous stream of data fragments that never end, forcing the server to store everything in memory until it crashes. This results in a total service outage (Denial of Service) and can be triggered by any user who can connect to the server's WebSocket endpoint.

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) within the `WSFrameAggregator` component of `http4s-blaze-server`. The server fails to bound the aggregate size of fragmented WebSocket messages, allowing a remote attacker to send an unterminated sequence of continuation frames. This causes unbounded heap growth in the JVM, eventually leading to an `OutOfMemoryError` and terminating the server process. The attack is particularly effective because small fragments incur per-object overhead, amplifying the memory impact relative to the actual bytes sent over the wire. The issue is resolved in versions 0.23.18 and 1.0.0-M42 by introducing a default 4 MiB aggregate limit.

Affected products

  • http4s http4s-blaze-server < 0.23.18, >= 1.0.0-M1, < 1.0.0-M42

Timeline

  • 2026-07-23: disclosed
  • 2026-07-23: patched: Versions 0.23.18 and 1.0.0-M42 released
  • 2026-07-24: advisory

References

Related threats