Executive brief
Http4s Ember is a Scala HTTP library that handles web traffic. When HTTP/2 is enabled on an Ember server or client, it fails to enforce the negotiated maximum number of concurrent streams, allowing an attacker to open unlimited streams and exhaust the server's memory, causing a service outage. This is an unauthenticated remote denial-of-service attack requiring only network access to the affected service.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-770) in the HTTP/2 implementation of Http4s Ember. The root cause is that the library does not enforce the SETTINGS_MAX_CONCURRENT_STREAMS parameter negotiated during HTTP/2 handshake. An unauthenticated attacker can open an unbounded number of concurrent streams over a single connection; each stream allocates per-stream server state that is never released, leading to heap exhaustion and denial of service. The same vulnerability affects Ember clients via malicious server-initiated PUSH_PROMISE frames. This is part of the HTTP/2 "Rapid Reset" family of attacks (CVE-2023-44487). Attack vector is network, requires no authentication or user interaction, and affects only systems with `.withHttp2` enabled. Patches are available in Http4s 0.23.35 and 1.0.0-M47.
Affected products
- http4s http4s-ember-core_2.12 <= 0.23.34
- http4s http4s-ember-core_2.13 <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46
- http4s http4s-ember-core_3 <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46
Timeline
- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released in versions 0.23.35 and 1.0.0-M47