The vulnerability stems from the shared WebSocket decoder in Http4s, which accepts arbitrarily large frames and accumulates fragments without bounding. A long sequence of fragmented messages causes the server to buffer increasingly large data. As the buffer grows beyond the limit of the JVM heap, memory exhaustion occurs, potentially leading to application crashes or degraded service. The flaw is classified as a denial of service problem (CWE-400) and an out‑of‑bounds resource issue (CWE-770).

All users of the http4s library older than version 0.23.35 or 1.0.0‑M47 are impacted when running a Blaze or Ember server that accepts WebSocket connections. The issue applies to any http4s‑blaze‑server or http4s‑ember‑server instance that performs a WebSocket handshake before the patch is applied.

With a CVSS score of 7.5 and an EPSS score of <1%, the vulnerability poses a high‑risk, very low likelihood of exploitation through an unauthenticated network connection. A WebSocket client can initiate a handshake and then transmit maliciously sized frames; the server will allocate memory proportional to the declared length, potentially exhausting system resources. The CVE is not listed in CISA KEV, but due to the unbounded memory allocation, attackers can feasibly exploit this vector from anywhere the endpoint is reachable. The risk is mitigated by patching, but without a patch, the vulnerability remains a practical DoS attack vector.