CyberRota Analysis
AI-GeneratedThe vulnerability affects the Http4s library, specifically the WebSocket decoder in versions prior to 0.23.35 and 1.0.0-M47, allowing remote clients to exhaust server memory by sending oversized frames or fragmented messages. This can lead to denial-of-service conditions on http4s-blaze-server or http4s-ember-server endpoints. Organizations using these versions should prioritize upgrading to the patched versions to mitigate the risk of memory exhaustion attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handshake against an http4s-blaze-server or http4s-ember-server endpoint can exhaust server memory with oversized frames or fragmented messages. The patched decoder applies a configurable 64 MiB default limit to individual frames and defragmented messages through EmberServerBuilder.withMaxWebSocketMessageSize. This issue is fixed in versions 0.23.35 and 1.0.0-M47.