Maven/org.http4s:http4s-blaze-server_2.12 CVE-2026-73493: high 7.5, EPSS 0.63%

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Action: Upgrade org.http4s:http4s-blaze-server_2.12 to 0.23.18 or later.

Affected

Fixed versions

Sources

• osv: GHSA-7ppr-r889-mcf2#Maven/org.http4s:http4s-blaze-server_2.12
• https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2
• https://github.com/http4s/blaze/commit/173e8ca820a0d12110bfe409c72e9b9c3d28d471
• https://github.com/http4s/blaze/commit/2ae13a74d55209b6573d5228d1aa94f0361a75d0
• https://github.com/http4s/blaze/commit/fadbe6d0f7f59045425688d313c8d4804973d12f
• https://github.com/http4s/blaze
• https://github.com/http4s/blaze/releases/tag/v0.23.18
• https://github.com/http4s/blaze/releases/tag/v1.0.0-M42

CVE-2026-73493 · published 2026-07-24T22:28:05Z · modified 2026-08-12T21:25:59.207322Z · JSON