Threats Tagged 'ghsa-7ppr-r889-mcf2'

The http4s-blaze-server aggregates incoming WebSocket message fragments without limiting total size or fragment count. An attacker completing a WebSocket handshake can send an unterminated fragmented message, causing unbounded heap growth in the server JVM and resulting in denial of service via OutOfMemoryError. This affects any http4s application using BlazeServerBuilder for WebSocket routes with versions prior to 0.23.18. No default configuration limits the aggregate buffer size, and the maxWebSocketBufferSize setting only limits individual frames. Mitigation involves limiting or terminating WebSocket traffic at a fronting layer or migrating to a maintained backend, as blaze-server is end-of-life upstream.