Executive brief
http4s is a popular Scala HTTP framework. When configured to use the Ember backend with HTTP/2, the library decodes compressed headers without enforcing a size limit on the decompressed data. An attacker can send specially crafted header frames that expand dramatically when decoded, exhausting server memory and causing denial of service. This affects any exposed http4s service or client that connects to untrusted servers.
Technical details
The vulnerability is a data amplification (HPACK bomb) flaw in the Ember backend's HTTP/2 header handling code. The issue occurs because Ember concatenates header and continuation frames, then decompresses all headers at once using HPACK. The maxHeaderSize configuration parameter does not account for indexed headers during decompression, allowing attackers to bypass the limit. Small compressed payloads decompress to significantly larger data structures held in memory as a single List, causing OutOfMemoryError with approximately 5 concurrent connections on a 2GB heap. The vulnerable component is org.http4s:http4s-ember-core (versions ≤0.23.34 and 1.0.0-M1 to 1.0.0-M46). A patch threads the maxHeaderSize parameter through the HPACK decoder to enforce size limits on decompressed data. Upgrades to 0.23.35 or 1.0.0-M47+ resolve the issue; workaround is to disable HTTP/2.
Affected products
- http4s http4s-ember-core 0.23.x <= 0.23.34
- http4s http4s-ember-core 1.0.0-M1 to 1.0.0-M46
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-08-26: advisory: GitHub reviewed and updated advisory
- 2026-08-26: patched: Patches released: 0.23.35 and 1.0.0-M47