{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-28T15:40:40.075","vulnerabilities":[{"cve":{"id":"CVE-2021-21294","sourceIdentifier":"security-advisories@github.com","published":"2021-02-02T22:15:12.387","lastModified":"2026-06-17T03:35:13.220","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. http4s provides a general \"MaxActiveRequests\" middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. In 0.21.17, 0.22.0-M2, and 1.0.0-M14, a new \"maxConnections\" property, with a default value of 1024, has been added to the `BlazeServerBuilder`. Setting the value to a negative number restores unbounded behavior, but is strongly disrecommended. The NIO2 backend does not respect `maxConnections`. Its use is now deprecated in http4s-0.21, and the option is removed altogether starting in http4s-0.22. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xhv5-w9c5-2r2w."},{"lang":"es","value":"Http4s (http4s-blaze-server) es una interfaz Scala mínima e idiomática para servicios HTTP. Http4s anterior a versiones 0.21.17, 0.22.0-M2 y 1.0.0-M14, presentan una vulnerabilidad que puede conllevar a una denegación de servicio. Blaze-core, una biblioteca subyacente a http4s-blaze-server, acepta conexiones ilimitadas en su grupo de selectores. Esto tiene el efecto neto de amplificar la degradación en los servicios que no pueden manejar su carga de peticiones actual, ya que las conexiones entrantes aún se aceptan y agregan a una cola ilimitada. Cada conexión asigna un identificador de socket, lo que agota un recurso escaso del sistema operativo. Esto también puede confundir a los disyuntores de nivel superior que funcionan basándose en la detección de conexiones en fallo. http4s proporciona un mecanismo de middleware \"MaxActiveRequests\" general para limitar las conexiones abiertas, pero se aplica dentro del bucle de aceptación de Blaze, después de que se acepta la conexión y se abre el socket. Por lo tanto, el límite solo impide el número de conexiones que se pueden procesar simultáneamente, no el número de conexiones que se pueden mantener abiertas. En 0.21.17, 0.22.0-M2 y 1.0.0-M14, se agregó una nueva propiedad \"maxConnections\", con un valor predeterminado de 1024, al \"BlazeServerBuilder\". Establecer el valor en un número negativo restaura el comportamiento ilimitado, pero se desaconseja enérgicamente. El backend de NIO2 no respeta \"maxConnections\". Su uso ahora es obsoleto en http4s-0.21, y la opción se elimina por completo a partir de http4s-0.22. Existen varias posibles soluciones que se describen en el Aviso de GitHub referenciado GHSA-xhv5-w9c5-2r2w"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"http4s","product":"http4s","versions":[{"version":"< 0.21.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","versionEndExcluding":"0.21.17","matchCriteriaId":"BB30E912-7ACF-41DA-A730-CEBAE7F25E21"}]}]}],"references":[{"url":"https://github.com/http4s/blaze/security/advisories/GHSA-xmw9-q7x9-j5qc","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/http4s/http4s/commit/987d6589ef79545b9bb2324ac4bdebf82d9a0171","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/http4s/http4s/security/advisories/GHSA-xhv5-w9c5-2r2w","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/http4s/blaze/security/advisories/GHSA-xmw9-q7x9-j5qc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/http4s/http4s/commit/987d6589ef79545b9bb2324ac4bdebf82d9a0171","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/http4s/http4s/security/advisories/GHSA-xhv5-w9c5-2r2w","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}