Skip to content
OpenAdvisories

Product · http4s

blaze

4 known vulnerabilities.

blaze at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202620
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.4
    CVE-2026-73494

    blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/par…

    http4s org.http4s blaze blaze-http_3 Maven
  • High 7.4
    CVE-2026-73495

    blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unau…

    http4s blaze org.http4s:blaze-http_2.13 org.http4s:blaze-http_3 Maven
  • High 7.5
    CVE-2026-73493

    http4s-blaze-server: Unbounded WebSocket message aggregation

    Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that comp…

    http4s blaze org.http4s:http4s-blaze-server_2.13 org.http4s:http4s-blaze-server_2.12 Maven
  • High 7.5
    CVE-2021-21293

    Unbounded connection acceptance leads to file handle exhaustion

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, ac…

    http4s blaze org.http4s:blaze-core_2.11 org.http4s:blaze-core_2.13 Maven