{"vulnerability": "ghsa-7ppr-r889-mcf2", "sightings": [{"uuid": "663b1220-495d-4a2a-a439-b42047edc958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7PPR-R889-MCF2", "type": "seen", "source": "https://gist.github.com/alon710/d38237d2a40144ae6c46815cd07e6744", "content": "# GHSA-7PPR-R889-MCF2: GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-7PPR-R889-MCF2\n\n## Summary\nAn uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.\n\n## TL;DR\nUnbounded WebSocket message aggregation in http4s-blaze-server allows unauthenticated remote attackers to crash the server with an OutOfMemoryError via a stream of tiny continuation fragments.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS**: 7.5\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: None (PoC verified theoretically)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s-blaze-server\n- **http4s-blaze-server**: < 0.23.18 (Fixed in: `0.23.18`)\n- **http4s-blaze-server**: < 1.0.0-M42 (Fixed in: `1.0.0-M42`)\n\n## Mitigation\n\n- Upgrade http4s-blaze-server dependencies to a patched version.\n- Configure maximum WebSocket buffer sizes to positive values to enforce limits and virtual frame overhead charges.\n\n**Remediation Steps:**\n1. Identify any instances of 'org.http4s:blaze-server' in your build.sbt, pom.xml, or build.gradle files.\n2. Update dependency declarations to version 0.23.18 or 1.0.0-M42.\n3. Verify that the BlazeServerBuilder is not configured with withMaxWebSocketBufferSize(0) or negative values, which would disable the validation checks.\n\n## References\n\n- [GitHub Security Advisory GHSA-7PPR-R889-MCF2](https://github.com/advisories/GHSA-7PPR-R889-MCF2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7PPR-R889-MCF2) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T18:31:07.881513Z"}]}