Security: http4s/blaze
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unbounded WebSocket message aggregation in http4s-blaze-serverGHSA-7ppr-r889-mcf2 published
Jul 23, 2026 by rossabakerHigh -
Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)GHSA-46q4-43ph-c6fr published
Jul 23, 2026 by rossabakerHigh -
Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserGHSA-mhvj-jhpq-885v published
Jul 23, 2026 by rossabakerHigh -
Unbounded connection acceptance leads to file handle exhaustionGHSA-xmw9-q7x9-j5qc published
Feb 2, 2021 by rossabakerHigh