CyberRota Analysis
AI-GeneratedThe vulnerability affects the Http4s Scala interface for HTTP services, specifically in the Ember backend when HTTP/2 is enabled. An unauthenticated HTTP/2 peer can exploit this flaw to trigger an out-of-memory denial of service by sending specially crafted header frames, potentially exhausting the server's heap memory. Organizations using affected versions and exposing their servers to untrusted HTTP/2 traffic should prioritize upgrading to versions 0.23.35 or 1.0.0-M47 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47.