Executive brief
Http4s is a Scala HTTP framework used to build web services with WebSocket support. The WebSocket frame decoder contains a vulnerability that allows remote clients to trigger an infinite decode loop by sending frames with negative payload lengths. An attacker can exploit this to cause complete CPU exhaustion and unbounded memory growth on affected servers, resulting in service unavailability.
Technical details
The WebSocket FrameTranscoder.bodyLength component in Http4s prior to versions 0.23.35 and 1.0.0-M47 incorrectly validates payload length fields in WebSocket frames. While it rejects lengths above Integer.MAX_VALUE, it fails to reject negative 64-bit length values. A remote client that completes a WebSocket handshake can send a specially crafted frame with a negative payload length, causing the decoder to return an empty frame without advancing the input buffer. This causes the decode loop to repeat indefinitely with the same malformed frame, consuming CPU at 100% and growing the internal ArrayBuffer without bound. The fix, available in versions 0.23.35 and 1.0.0-M47, adds proper validation to reject negative payload lengths.
Affected products
- Http4s Http4s before 0.23.35 and before 1.0.0-M47
Timeline
- 2026-09-15: disclosed
- 2026-07-06: patched: v0.23.35 released on July 6, 2026