Org.http4s:http4s blaze server 2.13: blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
Affects org.http4s:http4s-blaze-server_2.13Source GCVE Database
- Patch
- Available – fixed in 0.23.18, 1.0.0-M42
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mavenorg.http4s:http4s-blaze-server_2.13 | Affected
| Fixed in
|
| Mavenorg.http4s:http4s-blaze-server_2.13 | Affected
| Fixed in
|
| Mavenorg.http4s:http4s-blaze-server_2.12 | Affected
| Fixed in
|
| Mavenorg.http4s:http4s-blaze-server_3 | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The maxWebSocketBufferSize setting does not mitigate the issue. Recommended mitigations include terminating or limiting WebSocket traffic at a fronting layer that enforces message size and fragment limits, or disabling WebSocket routes entirely. For a longer-term solution, plan migration from the blaze-server backend to a maintained alternative such as ember, as blaze-server is end-of-life upstream.
Description
The http4s-blaze-server aggregates incoming WebSocket message fragments without limiting total size or fragment count. An attacker completing a WebSocket handshake can send an unterminated fragmented message, causing unbounded heap growth in the server JVM and resulting in denial of service via OutOfMemoryError. This affects any http4s application using BlazeServerBuilder for WebSocket routes with versions prior to 0.23.18. No default configuration limits the aggregate buffer size, and the maxWebSocketBufferSize setting only limits individual frames. Mitigation involves limiting or terminating WebSocket traffic at a fronting layer or migrating to a maintained backend, as blaze-server is end-of-life upstream.
Impact
The vulnerability allows remote unauthenticated attackers (if the WebSocket endpoint is unauthenticated) or authenticated clients (if authentication is required) to cause denial of service by exhausting server heap memory. This results in the termination of the JVM process running the blaze selector thread due to OutOfMemoryError. The impact is high as it disrupts availability of the affected http4s applications serving WebSocket routes over BlazeServerBuilder.
Summary
The vulnerability in org.http4s:http4s-blaze-server_2.13 allows unbounded aggregation of fragmented WebSocket messages. Specifically, the server buffers all fragments of an incoming WebSocket message with no limit on total size or fragment count. An attacker can exploit this by sending a fragmented message that never sets the FIN bit, causing the server to buffer fragments indefinitely. This leads to unbounded heap memory growth and eventual JVM OutOfMemoryError, resulting in denial of service. The issue affects all versions prior to 0.23.18. The maxWebSocketBufferSize parameter only limits individual frame sizes and does not mitigate the aggregation issue. No patch is currently available, and the blaze-server backend is end-of-life, with recommendations to migrate to a maintained backend such as ember.
Weaknesses
References
- github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2 (opens in a new tab)
- github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471 (opens in a new tab)
- github.com/http4s/blaze/commit/2ae13a74d55209b6573d5228d1aa94f0361a75d0 (opens in a new tab)
- github.com/http4s/blaze/commit/fadbe6d0f7f59045425688d313c8d4804973d12f (opens in a new tab)
- github.com/http4s/blaze (opens in a new tab)
- github.com/http4s/blaze/releases/tag/v0.23.18 (opens in a new tab)
- github.com/http4s/blaze/releases/tag/v1.0.0-M42 (opens in a new tab)