The vulnerability in org.http4s:http4s-blaze-server_2.13 allows unbounded aggregation of fragmented WebSocket messages. Specifically, the server buffers all fragments of an incoming WebSocket message with no limit on total size or fragment count. An attacker can exploit this by sending a fragmented message that never sets the FIN bit, causing the server to buffer fragments indefinitely. This leads to unbounded heap memory growth and eventual JVM OutOfMemoryError, resulting in denial of service. The issue affects all versions prior to 0.23.18. The maxWebSocketBufferSize parameter only limits individual frame sizes and does not mitigate the aggregation issue. No patch is currently available, and the blaze-server backend is end-of-life, with recommendations to migrate to a maintained backend such as ember.

The vulnerability allows remote unauthenticated attackers (if the WebSocket endpoint is unauthenticated) or authenticated clients (if authentication is required) to cause denial of service by exhausting server heap memory. This results in the termination of the JVM process running the blaze selector thread due to OutOfMemoryError. The impact is high as it disrupts availability of the affected http4s applications serving WebSocket routes over BlazeServerBuilder.

No official patch or configuration fix is currently available for this vulnerability. The maxWebSocketBufferSize setting does not mitigate the issue. Recommended mitigations include terminating or limiting WebSocket traffic at a fronting layer that enforces message size and fragment limits, or disabling WebSocket routes entirely. For a longer-term solution, plan migration from the blaze-server backend to a maintained alternative such as ember, as blaze-server is end-of-life upstream.