Executive brief
Http4s Ember is a Scala HTTP library that supports HTTP/2 protocol. When HTTP/2 is enabled, an unauthenticated remote attacker can send specially crafted header frames that cause the server or client to accumulate data in memory without bounds, eventually exhausting heap memory and crashing the service. For servers, this attack requires only an ability to reach the HTTP/2 endpoint; for clients, a malicious server can trigger the issue.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in Http4s Ember's HTTP/2 implementation. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without the END_HEADERS flag, it buffers the header block fragment and waits for CONTINUATION frames. If an attacker sends many CONTINUATION frames without completing the header block, these fragments accumulate unbounded until the connection closes. For ember-server with .withHttp2 enabled, any HTTP/2 client can trigger this against any path with no authentication required. For ember-client, a malicious origin server can trigger it via response headers. The fix bounds accumulated header-block size at SETTINGS_MAX_HEADER_LIST_SIZE and terminates the connection with GOAWAY when that limit is exceeded. Patches are available in version 0.23.35 and 1.0.0-M47.
Affected products
- http4s http4s-ember-core <= 0.23.34
- http4s http4s-ember-core (1.0.0 series) >= 1.0.0-M1, <= 1.0.0-M46
Timeline
- 2026-09-15: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released: v0.23.35 and v1.0.0-M47