CyberRota Analysis
AI-GeneratedEmber HTTP/2 in Http4s versions prior to 0.23.35 and 1.0.0-M47 is vulnerable to a denial-of-service attack due to unbounded queue handling, allowing unauthenticated clients to overwhelm server memory by sending excessive frames. This can lead to server crashes or degraded performance, particularly in environments utilizing HTTP/2. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause Ember to enqueue acknowledgments or WINDOW_UPDATE frames faster than the writer drains them, exhausting heap memory on a server built with withHttp2. The shared behavior also affects an ember-client connected to a hostile HTTP/2 server, and the patch replaces the unbounded path with bounded, backpressured outbound queues. This issue is fixed in versions 0.23.35 and 1.0.0-M47.