CVE-2021-21293: 
Java vulnerability analysis and mitigation

All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. The vulnerability was discovered and disclosed on February 2, 2021, and is tracked as CVE-2021-21293. The issue affects the org.http4s::blaze-core Scala package and its dependent packages including blaze-http and http4s-blaze-server (GitHub Advisory).

The vulnerability stems from Blaze accepting connections unconditionally on a dedicated thread pool. This implementation accepts incoming connections and adds them to an unbounded queue, even when services are unable to handle their current request load. Each connection allocates a socket handle, which consumes scarce OS resources. While http4s provides a mechanism for limiting open connections, it is enforced inside the Blaze accept loop after the connection is accepted and the socket opened, thus only limiting simultaneously processed connections rather than preventing excess connections from being held open (GitHub Advisory).

The vulnerability can lead to amplified service degradation in systems unable to handle their current request load, as connections continue to be accepted and queued unboundedly. This behavior drains scarce OS resources through socket handle allocation and can interfere with higher-level circuit breakers that work based on detecting failed connections (GitHub Advisory).

The vulnerability can be triggered by establishing multiple connections to an affected server. No specific exploit code or reports of exploitation in the wild were mentioned in the available sources.

The issue is fixed in blaze-core version 0.14.15, which introduces a maxConnections parameter defaulting to 512 concurrent connections. For temporary mitigation, users can implement an Nginx side-car as a reverse proxy to apply connection limiting before requests reach blaze-core. Alternative solutions include using http4s-ember-server, http4s-jetty, or http4s-tomcat, though these may lack certain features like HTTP/2 or websocket support (GitHub Advisory).