CVE-2026-73493 http4s CVE debrief

Who should care

Defenders of http4s applications serving WebSocket routes over BlazeServerBuilder should assess exposure and prioritize upgrading to fixed versions 0.23.18 or 1.0.0-M42. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also monitor for unusual WebSocket traffic patterns and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-73493 is a high-severity vulnerability in http4s-blaze-server that can lead to denial of service through OutOfMemoryError. Defenders of http4s applications serving WebSocket routes over BlazeServerBuilder should assess exposure and prioritize upgrading to fixed versions 0.23.18 or 1.0.0-M42.

• Denial of service through OutOfMemoryError
• Potential for heap exhaustion through unterminated WebSocket fragmented messages
• Need for upgrading to fixed versions to prevent exploitation

Technical summary

Http4s (http4s-blaze-server) aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count, allowing a client to drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. This vulnerability affects any http4s application serving WebSocket routes over BlazeServerBuilder, and defenders should prioritize upgrading to fixed versions 0.23.18 or 1.0.0-M42. The vulnerability allows a client to send unterminated fragmented messages, causing the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread.

Defensive priority

Defenders should prioritize upgrading to fixed versions 0.23.18 or 1.0.0-M42, and assess exposure of WebSocket routes served over BlazeServerBuilder.

Recommended defensive actions

• Upgrade to http4s-blaze-server version 0.23.18 or 1.0.0-M42
• Assess exposure of WebSocket routes served over BlazeServerBuilder
• Monitor for unusual WebSocket traffic patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, specific details on exploitation or victim organizations are not provided. The vulnerability has been publicly disclosed and defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. There is no evidence of exploitation in the wild, but defenders should monitor for unusual WebSocket traffic patterns. The http4s-blaze-server aggregates fragments of an incoming WebS

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.