CyberRota Analysis
AI-GeneratedEmber's HTTP/2 implementation in Http4s versions prior to 0.23.35 and 1.0.0-M47 is vulnerable due to improper flow-control management, allowing a malicious peer to overwhelm the application with data, leading to potential denial of service through excessive memory consumption. This vulnerability should be prioritized by organizations using affected versions of Http4s in their Scala applications, particularly those exposed to untrusted network sources. Immediate upgrading to the patched versions is essential to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.