Description

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T22:17:16.673Z",
  "pubdate": "2026-08-12T22:17:16.673Z",
  "executiveSummary": "Http4s-blaze-server is vulnerable to an unbounded memory consumption denial of service vulnerability via WebSocket fragment aggregation. The vulnerability stems from the absence of limits on the total size and fragment count of incoming fragmented WebSocket messages. Attackers can exploit this to cause an OutOfMemoryError in the server JVM.\nThe impact of successful exploitation is a complete denial of service through JVM termination on the blaze selector thread. Affected systems include any http4s application serving WebSocket routes over BlazeServerBuilder utilizing vulnerable software versions. The risk implications are severe as the disruption halts service availability.\nThe attacker capabilities required are minimal; a remote client that completes a WebSocket handshake can initiate the attack. Exploitation requirements are trivial as no non-default configuration is required. A modest volume of wire bytes utilizing small fragments is sufficient to amplify the cost through per-frame object overhead and exhaust the heap.",
  "technicalDetails": "The root cause of the vulnerability resides in the http4s-blaze-server WebSocket message handling logic, specifically within fragment aggregation prior to versions 0.23.18 and 1.0.0-M42. When processing incoming WebSocket communication, the server aggregates fragments of a fragmented WebSocket message without enforcing any upper boundaries on the cumulative size or the total count of fragments.\nThe vulnerable component is the http4s-blaze-server module, specifically affecting applications utilizing BlazeServerBuilder to serve WebSocket routes. While the configuration parameter maxWebSocketBufferSize exists, it fails to mitigate this issue because it exclusively bounds individual frames rather than the aggregate payload of a multi-fragment message stream.\nAuthentication and privilege requirements are absent beyond the ability to establish a standard network connection and complete a basic WebSocket handshake. Network exposure is present wherever WebSocket routes are exposed to untrusted clients over the network protocol stack.\nThe attack flow proceeds as follows. First, the malicious client establishes a TCP connection and successfully completes the standard WebSocket handshake with the http4s-blaze-server application. Second, the client begins transmitting an unterminated fragmented WebSocket message. The client continuously sends continuation frames that intentionally omit setting the FIN flag. Third, the server receives these fragments and continuously buffers every incoming fragment into JVM heap memory without checking cumulative thresholds.\nBecause the server lacks validation on aggregate message size or fragment count, the payload behavior forces continuous heap allocation. Small fragments heavily amplify the cost due to per-frame object overhead in the JVM runtime. Consequently, a relatively modest volume of raw wire bytes is sufficient to rapidly consume available memory.\nThe post-exploitation impact culminates in heap exhaustion, triggering a fatal OutOfMemoryError. This error terminates the JVM execution specifically on the blaze selector thread, leading to an immediate and total denial of service for the affected server instance."
}