EUVD-2026-79183
GHSA-8f3q-3jmv-7prw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote peer with no user interaction stalls the socket, so AV:N/AC:L/PR:N/UI:N; only availability is impacted via heap exhaustion.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5Blast Radius
ecosystem impact- 3 maven packages depend on org.http4s:http4s-ember-core_2.12 (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 0.23.35.
DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause Ember to enqueue acknowledgments or WINDOW_UPDATE frames faster than the writer drains them, exhausting heap memory on a server built with withHttp2. The shared behavior also affects an ember-client connected to a hostile HTTP/2 server, and the patch replaces the unbounded path with bounded, backpressured outbound queues. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
Heap memory exhaustion in the Ember HTTP/2 backend of http4s allows an unauthenticated remote peer to crash a server built with withHttp2 by sending PING, SETTINGS, or DATA frames faster than the write loop can drain the outbound frame queue. Because outbound frames are serialized through a single unbounded queue (cats.effect.std.Queue.unbounded) prior to versions 0.23.35 and 1.0.0-M47, acknowledgements and WINDOW_UPDATE responses accumulate without limit when the peer simply stops reading, ultimately triggering an OutOfMemoryError. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a server or client actually using the Ember HTTP/2 implementation - i.e., server code built with withHttp2, or an ember-client pointed at an attacker-controlled HTTP/2 server; HTTP/1.1-only or non-Ember backends are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - a high-severity, unauthenticated, low-complexity network denial of service against availability only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to http4s 0.23.35 or 1.0.0-M47, which replace the unbounded outbound frame queue with a bounded (128-entry) backpressured queue in both H2Server.scala and H2Client.scala (see https://github.com/http4s/http4s/releases/tag/v0.23.35 and https://github.com/http4s/http4s/releases/tag/v1.0.0-M47, advisory https://github.com/http4s/http4s/security/advisories/GHSA-8f3q-3jmv-7prw). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today