CyberRota Analysis
AI-GeneratedThe vulnerability affects Http4s versions prior to 0.23.35 and 1.0.0-M47, allowing a remote client to exploit the WebSocket FrameTranscoder by sending negative 64-bit payload lengths. This can lead to a denial of service as the decode loop runs indefinitely, consuming CPU resources and causing an unbounded increase in memory usage. Organizations using affected versions of Http4s should prioritize updating to the patched versions to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.