Http4s-blaze-server concatenates incoming WebSocket frames without imposing any overall size or count limit. A downstream client that completes a WebSocket handshake can transmit an unterminated fragmented message by never setting the FIN flag, causing the server to buffer each fragment indefinitely. The accumulation of these fragments eventually exhausts the JVM heap and triggers an OutOfMemoryError, terminating the blaze selector thread and rendering the service unavailable.

The vulnerability affects the http4s BlazeServerBuilder component of http4s-blaze-server. All parsable http4s installations using versions earlier than 0.23.18 or 1.0.0-M42 are impacted; the issue is resolved in those releases.

The CVSS score of 7.5 indicates a high likelihood of serious impact if exploited. Since EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, known exploitation activity has not been reported, but the remote nature of the attack via any WebSocket client makes it readily actionable. No authentication or privileged state is required; any client reaching the WebSocket endpoint can trigger the denial of service.