Executive brief
Http4s Ember is a Scala HTTP server and client library. An unauthenticated attacker can cause the HTTP/2 implementation to buffer extremely large frames in memory before validating the frame size, leading to memory exhaustion and service unavailability. By exploiting the order of frame parsing operations, an attacker can consume gigabytes of heap memory with minimal network bandwidth.
Technical details
The vulnerability exists in Http4s Ember's HTTP/2 frame parsing logic. The H2Frame.RawFrame.fromByteVector function reads a frame's declared payload length from the first 9 bytes without checking it against SETTINGS_MAX_FRAME_SIZE. The readLoop then buffers the entire payload into a contiguous accumulator before the frame is passed to processFrame, which performs the actual size validation. This means oversized frames or incomplete frames with large declared lengths can consume up to 16 MiB per connection (amplified 1024x over the advertised 16 KiB limit). At the default 1024 concurrent connections, this can exhaust approximately 16 GiB of heap. An attacker can trigger this by either sending a complete oversized frame or slowly dribbling a payload while declaring a maximum size (16 MiB), keeping the connection alive indefinitely without violating idle timeouts. Patched versions validate frame size before or during buffering.
Affected products
- Http4s http4s-ember-core 0.23.36 and earlier (all Scala versions: 2.12, 2.13, 3); 1.0.0-M1 through 1.0.0-M47
Timeline
- 2026-09-15: disclosed: GitHub Advisory Database published
- 2026-09-08: advisory: GitHub reviewed advisory
- 2026-09-15: patched: Patched in version 0.23.37 and 1.0.0-M48