7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
http4s-blaze-server: Unbounded WebSocket message aggregation
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of service through OutOfMemoryError. Any http4s application serving WebSocket routes over BlazeServerBuilder is affected, no non-default configuration is required, and maxWebSocketBufferSize does not bound the aggregate because it bounds only individual frames. A single connection sending continuation frames that never set FIN forces the server to buffer every fragment until the heap is exhausted, terminating the JVM with OutOfMemoryError on the blaze selector thread. Small fragments amplify the cost through per-frame object overhead, so a modest volume of wire bytes is sufficient. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
References
-
https://github.com/http4s/blaze/security/advisories/GHSA-7ppr-r889-mcf2 x_refsource_CONFIRM
-
https://github.com/http4s/blaze/releases/tag/v0.23.18 x_refsource_MISC
-
https://github.com/http4s/blaze/releases/tag/v1.0.0-M42 x_refsource_MISC
Affected products
- ==< 0.23.18
- ==>= 1.0.0-M1, < 1.0.0-M42
Matching in nixpkgs
pkgs.blaze
High performance C++ math library
pkgs.mblaze
Unix utilities for processing and interacting with mail messages which are stored in maildir folders
pkgs.blazesym-c
C language bindings for the blazesym library
pkgs.backblaze-b2
Command-line tool for accessing the Backblaze B2 storage service
pkgs.haskellPackages.blaze
None
pkgs.haskellPackages.blaze-svg
SVG combinator library
pkgs.haskellPackages.blaze-html
A blazingly fast HTML combinator library for Haskell
pkgs.haskellPackages.blaze-htmx
Blaze integration of the htmx library
pkgs.haskellPackages.snap-blaze
blaze-html integration for Snap
pkgs.haskellPackages.blazeMarker
...
pkgs.haskellPackages.blaze-markup
A blazingly fast markup combinator library for Haskell
pkgs.haskellPackages.blaze-builder
Efficient buffered output
pkgs.haskellPackages.blaze-textual
Fast rendering of common datatypes
pkgs.haskellPackages.servant-blaze
Blaze-html support for servant
pkgs.haskellPackages.ihaskell-blaze
IHaskell display instances for blaze-html types
pkgs.haskellPackages.blaze-bootstrap
Blaze helper functions for bootstrap pages
pkgs.haskellPackages.blaze-from-html
Tool to convert HTML to BlazeHtml code
pkgs.haskellPackages.blaze-builder-conduit
Convert streams of builders to streams of bytestrings. (deprecated)
pkgs.haskellPackages.digestive-functors-blaze
Blaze frontend for the digestive-functors library
pkgs.haskellPackages.skylighting-format-blaze-html
HTML formatter for skylighting syntax highlighting library
Package maintainers
-
@phaer Paul Haerle <nix@phaer.org>
-
@aaronjheng Aaron Jheng <wentworth@outlook.com>
-
@axgfn Alex Griffin <a@ajgrf.com>