CyberRota Analysis
AI-GeneratedAn Ember server using Http4s with HTTP/2 enabled is vulnerable to an unchecked allocation issue, allowing unauthenticated connections to create an unbounded number of streams, potentially leading to heap exhaustion. This vulnerability can be exploited through peer-created streams and server-initiated PUSH_PROMISE frames, impacting the server's stability and performance. Organizations using affected versions should prioritize upgrading to 0.23.35 or 1.0.0-M47 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.