GHSA-7PPR-R889-MCF2: GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

#security #cve #cybersecurity #ghsa

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

Vulnerability ID: GHSA-7PPR-R889-MCF2
CVSS Score: 7.5
Published: 2026-07-24

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

TL;DR

Unbounded WebSocket message aggregation in http4s-blaze-server allows unauthenticated remote attackers to crash the server with an OutOfMemoryError via a stream of tiny continuation fragments.

Technical Details

CWE ID: CWE-400
Attack Vector: Network
CVSS: 7.5
Impact: Denial of Service (DoS)
Exploit Status: None (PoC verified theoretically)
KEV Status: Not Listed

Affected Systems

http4s-blaze-server
http4s-blaze-server: < 0.23.18 (Fixed in: 0.23.18)
http4s-blaze-server: < 1.0.0-M42 (Fixed in: 1.0.0-M42)

Code Analysis

Commit: 173e8ca

Cap aggregated message size and charge footprint overhead per fragment

Commit: fadbe6d

Align decoder and aggregator buffer sizes

Commit: 2ae13a7

Restore binary compatibility

Mitigation Strategies

Upgrade http4s-blaze-server dependencies to a patched version.
Configure maximum WebSocket buffer sizes to positive values to enforce limits and virtual frame overhead charges.

Remediation Steps:

Identify any instances of 'org.http4s:blaze-server' in your build.sbt, pom.xml, or build.gradle files.
Update dependency declarations to version 0.23.18 or 1.0.0-M42.
Verify that the BlazeServerBuilder is not configured with withMaxWebSocketBufferSize(0) or negative values, which would disable the validation checks.