Executive brief
Http4s Ember is a Scala HTTP server and client library with HTTP/2 support. The HTTP/2 implementation uses an unbounded queue for outgoing network frames, which can grow without limit when the network write side stalls. An unauthenticated attacker can send inexpensive control frame requests to trigger automatic responses from the server or client, causing the queue to fill and exhaust available memory, crashing the process. This results in service outage with minimal attacker effort.
Technical details
The vulnerability is an unbounded resource consumption issue (CWE-400, CWE-770) in the Ember HTTP/2 connection handler. Outgoing frames are serialized through a single unbounded queue (`writeLoop` fiber) without flow control limits. When the network write side stalls or slows, legitimate frame production accumulates indefinitely in memory. An attacker can cheaply trigger automatic control frame responses (PING ACK, SETTINGS ACK, WINDOW_UPDATE) by sending unauthenticated control frames; the peer will generate matching responses without bounds. This affects both Ember servers (attacked by malicious clients) and Ember clients (attacked by malicious or compromised servers that send data and stall reading ACKs). A single connection can exhaust heap and trigger out-of-memory (OOM) crashes. Patches are available: versions 0.23.35 and 1.0.0-M47 and later bound the queue size. Workaround: disable HTTP/2 by not calling `.withHttp2()`.
Affected products
- http4s http4s-ember-core <=0.23.34
- http4s http4s-ember-core >=1.0.0-M1, <=1.0.0-M46
Timeline
- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026: patched: Patched in versions 0.23.35 and 1.0.0-M47