Skip to content
OpenAdvisories

Package · Maven

org.http4s:http4s-blaze-server_2.13

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.4
    CVE-2026-73494

    blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/par…

    http4s org.http4s blaze blaze-http_2.13 Maven
  • High 7.5
    CVE-2026-73493

    http4s-blaze-server: Unbounded WebSocket message aggregation

    Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that comp…

    http4s blaze org.http4s:http4s-blaze-server_2.13 org.http4s:http4s-blaze-server_2.12 Maven
  • High 7.5
    CVE-2021-21294

    Unbounded connection acceptance in http4s-blaze-server

    Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, …

    http4s http4s org.http4s:http4s-blaze-server_2.13 org.http4s:http4s-blaze-server_2.12 Maven