http4s blaze

• CVE-2026-73494 High 7.4 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser 0.6%
• CVE-2026-73495 High 7.4 blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) 0.5%
• CVE-2026-73493 High 7.5 http4s-blaze-server: Unbounded WebSocket message aggregation 0.6%
• CVE-2021-21293 High 7.5 Unbounded connection acceptance leads to file handle exhaustion 2.1%