CVE-2026-73495 debrief: The Blaze library, used for building asynchronous pipelines, has a vulnerability that allows unauthenticated remote clients to inject arbitrary headers into http4s applications using BlazeServerBuilder over HTTP/1.1. This can lead to bypassing header-based trust decisions, spoofing client IP for allow-lists, rate limits, or auditing, forging the https scheme, or injecting internal [truncated]
CVE-2026-73493 debrief: Http4s (http4s-blaze-server) is vulnerable to unbounded heap growth through unterminated WebSocket fragmented messages, leading to denial of service via OutOfMemoryError. This affects any http4s application serving WebSocket routes over BlazeServerBuilder. The issue is fixed in versions 0.23.18 and 1.0.0-M42. Defenders should assess exposure and prioritize upgrading to these versio [truncated]
