GHSA-7ppr-r889-mcf2: blaze: Unbounded WebSocket message aggregation in http4s-blaze-server
http4s-blaze-server aggregates the fragments of an incoming WebSocket
message with no limit on total size or fragment count. A client that
completes a WebSocket handshake can send an unterminated fragmented
message and drive unbounded heap growth in the server JVM, resulting in
denial of service via OutOfMemoryError.
References
- github.com/advisories/GHSA-7ppr-r889-mcf2
- github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471
- github.com/http4s/blaze/commit/2ae13a74d55209b6573d5228d1aa94f0361a75d0
- github.com/http4s/blaze/commit/fadbe6d0f7f59045425688d313c8d4804973d12f
- github.com/http4s/blaze/releases/tag/v0.23.18
- github.com/http4s/blaze/releases/tag/v1.0.0-M42
- github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2
Code Behaviors & Features
Detect and mitigate GHSA-7ppr-r889-mcf2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →