CVE-2026-73493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73493", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.735Z", "datePublished": "2026-08-12T21:08:34.981Z", "dateUpdated": "2026-08-13T17:53:19.342Z"}, "containers": {"cna": {"title": "http4s-blaze-server: Unbounded WebSocket message aggregation", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2"}, {"name": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471"}, {"name": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"}, {"name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "tags": ["x_refsource_MISC"], "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"}], "affected": [{"vendor": "http4s", "product": "blaze", "versions": [{"version": "< 0.23.18", "status": "affected"}, {"version": ">= 1.0.0-M1, < 1.0.0-M42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:08:34.981Z"}, "descriptions": [{"lang": "en", "value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}], "source": {"advisory": "GHSA-7ppr-r889-mcf2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:49:17.058412Z", "id": "CVE-2026-73493", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:53:19.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:49:17.058412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:49:18.310Z"}}], "cna": {"title": "http4s-blaze-server: Unbounded WebSocket message aggregation", "source": {"advisory": "GHSA-7ppr-r889-mcf2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "http4s", "product": "blaze", "versions": [{"status": "affected", "version": "< 0.23.18"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M42"}]}], "references": [{"url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2", "name": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471", "name": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "name": "https://github.com/http4s/blaze/releases/tag/v0.23.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T21:08:34.981Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73493", "state": "PUBLISHED", "dateUpdated": "2026-08-13T17:53:19.342Z", "dateReserved": "2026-08-12T19:00:33.735Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T21:08:34.981Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "blaze", "vendor": "http4s", "versions": [{"status": "affected", "version": "< 0.23.18"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M42"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42."}, {"lang": "es", "value": "Http4s (http4s-blaze-server) es una interfaz Scala m\u00ednima e idiom\u00e1tica para servicios HTTP. Antes de 0.23.18 y 1.0.0-M42, http4s-blaze-server agrega fragmentos de un mensaje WebSocket entrante sin l\u00edmite en el tama\u00f1o total o el recuento de fragmentos. Un cliente que completa un handshake WebSocket puede enviar un mensaje fragmentado no terminado y provocar un crecimiento ilimitado del heap en la JVM del servidor, lo que resulta en una denegaci\u00f3n de servicio a trav\u00e9s de OutOfMemoryError. Cualquier aplicaci\u00f3n http4s que sirva rutas WebSocket sobre BlazeServerBuilder se ve afectada, no se requiere ninguna configuraci\u00f3n no predeterminada, y maxWebSocketBufferSize no limita el agregado porque solo limita los frames individuales. Una \u00fanica conexi\u00f3n que env\u00eda frames de continuaci\u00f3n que nunca establecen FIN fuerza al servidor a almacenar en b\u00fafer cada fragmento hasta que el heap se agota, terminando la JVM con OutOfMemoryError en el hilo selector de blaze. Los fragmentos peque\u00f1os amplifican el costo a trav\u00e9s de la sobrecarga de objetos por frame, por lo que un volumen modesto de bytes en la red es suficiente. Este problema est\u00e1 solucionado en las versiones 0.23.18 y 1.0.0-M42."}], "id": "CVE-2026-73493", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73493", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T17:49:17.058412Z", "version": "2.0.3"}}]}, "published": "2026-08-12T22:17:16.673", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"}, {"source": "security-advisories@github.com", "url": "https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.23.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0-M1,1.0.0-M42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "blaze", "source": "cna", "vendor": "http4s"}, "product": "blaze", "vendor": "http4s"}], "created": "2026-08-12T23:00:05.002363+00:00", "updated": "2026-08-13T02:30:12.394608+00:00", "vendors": ["http4s", "http4s$PRODUCT$blaze"]}