CVE-2026-69209: Http4s: WebSocket decoder accepts unbounded message sizes
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handshake against an http4s-blaze-server or http4s-ember-server endpoint can exhaust server memory with oversized frames or fragmented messages. The patched decoder applies a configurable 64 MiB default limit to individual frames and defragmented messages through EmberServerBuilder.withMaxWebSocketMessageSize. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s-blaze-server/http4s-ember-serverto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s-blaze-server/http4s-ember-serverto a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Configuration
If using http4s-ember-server, set EmberServerBuilder.withMaxWebSocketMessageSize to a defined maximum (the patched decoder applies a configurable 64 MiB default) to limit individual WebSocket frames and defragmented messages.
EmberServerBuilder (http4s-ember-server) withMaxWebSocketMessageSize = 64 MiB default limit (configurable)
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
http4s applications that expose WebSocket endpoints through http4s-blaze-server or http4s-ember-server are exposed if they use a version earlier than 0.23.35 or 1.0.0-M47. A remote client only needs to complete a WebSocket handshake with the endpoint.
What does an attacker need to send to trigger the issue?
An attacker can send an oversized WebSocket frame or a fragmented WebSocket message. The vulnerable decoder can buffer the data without a limit, allowing server memory exhaustion.
Is there a size limit after upgrading?
Yes. The patched decoder applies a configurable default limit of 64 MiB to individual frames and defragmented messages. The limit is configured through EmberServerBuilder.withMaxWebSocketMessageSize.
How can I determine whether an application is affected?
Check whether the application provides a WebSocket endpoint using http4s-blaze-server or http4s-ember-server, then verify its http4s version. Versions before 0.23.35 and 1.0.0-M47 are affected.