GHSA-9vwc-pc8p-253q: High severity maven/org.http4s:http4s-ember-core_3 vulnerability
An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.
Impact
Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).
The same unchecked allocation path is reachable on the client via server-initiated PUSHPROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.
Preconditions
- Server: with .withHttp2 enabled. - Client: makes HTTP/2 requests to malicious or compromised sites. enablePush is not enforced.
Workarounds
- Disable HTTP/2 on EmberServerBuilder or EmberClientBuilder (default) - Client only: avoid HTTP/2 to untrusted servers until patched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.http4s:http4s-ember-core_3to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-core_2.13to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-core_3to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-core_2.13to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-core_2.12to a version that resolves this vulnerability.Fixed in 0.23.35 - Configuration
Disable HTTP/2 by not enabling `.withHttp2` on `EmberServerBuilder` and `EmberClientBuilder` (workaround: “Disable HTTP/2 on `EmberServerBuilder` or `EmberClientBuilder` (default)”).
EmberServerBuilder / EmberClientBuilder withHttp2 = disable - Configuration
Avoid making HTTP/2 requests to untrusted servers until the issue is patched.
HTTP/2 (client/server usage) HTTP/2 to untrusted servers = avoid
Event History
Frequently Asked Questions
Which deployments are exposed by default?
HTTP/2 is disabled by default on both EmberServerBuilder and EmberClientBuilder. Servers are exposed only when built with .withHttp2; clients are exposed when they make HTTP/2 requests to malicious or compromised sites.
What does an attacker need to exploit an affected server?
An attacker needs only network access to the HTTP/2-enabled server. A single unauthenticated connection can open unlimited concurrent streams and exhaust heap memory.
Are clients affected even if HTTP/2 server push is not intentionally enabled?
Yes. The client-side allocation path is reachable through server-initiated PUSH_PROMISE frames, and enablePush is not enforced. A malicious or compromised HTTP/2 server can therefore exhaust the client's heap.
What can be done if patching cannot happen immediately?
Disable HTTP/2 on EmberServerBuilder or EmberClientBuilder. For clients, avoid HTTP/2 connections to untrusted servers until patched.