http4s blaze vulnerabilities

4 published CVEs name http4s blaze among the affected products.

Critical 0High 4Medium 0Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-73494
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
http4s · blaze
High7.4
CVE-2026-73495
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
http4s · blaze
High7.4
CVE-2026-73493
http4s-blaze-server: Unbounded WebSocket message aggregation
http4s · blaze
High7.5
CVE-2021-21293
Unbounded connection acceptance leads to file handle exhaustion
http4s · blaze
High7.5