EUVD-2026-66558
GHSA-vmm3-xgcx-67hm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
HTTP/2 must be explicitly enabled (non-default), warranting AC:H; no authentication or user interaction required; impact is availability-only JVM crash.
Primary rating from Vendor (https://github.com/http4s/http4s).
CVSS VectorVendor: https://github.com/http4s/http4s
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6Blast Radius
ecosystem impact- 2 maven packages depend on org.http4s:http4s-ember-core_2.12 (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.23.35.
DescriptionCVE.org
Summary
http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers.
Impact
Denial of Service:
- Affects any http4s server running the ember backend with HTTP/2 enabled that is exposed to untrusted traffic.
- Affects any http4s client running the ember backend with HTTP/2 enabled that can be directed to an untrusted server.
Details
The issue occurs in the Hpack wrapper. Ember concatenates the header and continuation frames before decoding all headers at once. When the code decodes the attack payload, the relatively small packets decode to a significantly larger amount of data which is returned as a single List which is then held in memory for further processing. With enough concurrent connections (~5 with a 2GB heap in testing) this leads to an OOM, eg:
java.lang.OutOfMemoryError: Java heap space
at scala.collection.mutable.ListBuffer.scala$collection$mutable$ListBuffer$$freshFrom(ListBuffer.scala:129)
at scala.collection.mutable.ListBuffer.addAll(ListBuffer.scala:147)
at scala.collection.mutable.ListBuffer.addAll(ListBuffer.scala:40)
at scala.collection.mutable.Growable.$plus$plus$eq(Growable.scala:69)
at scala.collection.mutable.Growable.$plus$plus$eq$(Growable.scala:69)
at scala.collection.mutable.AbstractBuffer.$plus$plus$eq(Buffer.scala:314)
at org.http4s.Header$.org$http4s$Header$ToRaw$$anon$10$$_$$lessinit$greater$$anonfun$2(Header.scala:192)
at org.http4s.Header$ToRaw$$anon$10$$Lambda/0x00001fe001239c50.apply(Unknown Source)
at scala.collection.immutable.List.foreach(List.scala:334)
at org.http4s.Header$ToRaw$$anon$10.<init>(Header.scala:192)
at org.http4s.Header$ToRaw$.scalaCollectionSeqToRaw(Header.scala:195)
at org.http4s.Headers$.apply(Headers.scala:220)
at org.http4s.ember.core.h2.PseudoHeaders$.headersToRequestNoBody(PseudoHeaders.scala:95)
at org.http4s.ember.core.h2.H2Stream.receiveHeaders$$anonfun$1$$anonfun$2$$anonfun$3$$anonfun$2(H2Stream.scala:248)
at org.http4s.ember.core.h2.H2Stream$$Lambda/0x00001fe001511fd8.apply(Unknown Source)
at cats.effect.IOFiber.runLoop(IOFiber.scala:429)
at cats.effect.IOFiber.autoCedeR(IOFiber.scala:1460)
at cats.effect.IOFiber.run(IOFiber.scala:129)
at cats.effect.unsafe.WorkerThread.run(WorkerThread.scala:935)Fix
The Hpack handling code has a configurable max header size parameter, but it does not include indexed headers in that accounting, allowing the attack to bypass the limit. There is not any configuration available in current http4s versions that can be enabled to prevent this attack short of disabling http2.
A fix has been tested locally that threads the maxHeaderSize setting from the server builder into the Hpack code. Using this, connections can be prematurely terminated once the decoded data size exceeds the maxHeaderSize that users can already configure.
Workarounds
If you can't upgrade immediately:
- Disable HTTP/2 in Ember backends
Articles & Coverage 2
AnalysisAI
Denial of service via HPACK bomb in http4s ember-core's HTTP/2 implementation allows unauthenticated remote attackers to exhaust JVM heap memory and crash affected servers or clients. The flaw resides in the Hpack wrapper (Hpack.scala:L54), where HEADERS and CONTINUATION frames are concatenated and decoded wholesale into a Scala List before any size limit is enforced; the existing maxHeaderSize guard is bypassed entirely because it does not account for indexed headers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | HTTP/2 must be explicitly enabled in the http4s ember backend - deployments using HTTP/1.1 only, or using backends other than ember (e.g., blaze, netty-client), are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) correctly reflects that the attack is network-accessible and unauthenticated with high availability impact, while AT:P acknowledges a meaningful prerequisite: HTTP/2 must be explicitly enabled in the ember backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to http4s-ember-core 0.23.35 (0.23.x series) or 1.0.0-M47 (1.0.0 milestone series), available at https://github.com/http4s/http4s/releases/tag/v0.23.35 and https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications using http4s ember-core and assess network exposure, particularly publicly accessible services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today