GHSA-fm4g-76c9-7w69: High severity maven/org.http4s:http4s-ember-server_3 vulnerability
The DigestAuth server middleware's stale-nonce cleanup uses an inverted comparison: it removes fresh nonces and stops at the first stale one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow without bound until the JVM runs out of heap.
Impact
Unauthenticated remote denial of service (gradual heap exhaustion / OOM) against any service using DigestAuth. The leak is persistent.
Preconditions
- Application uses DigestAuth on at least one route.
Workarounds
- Front the DigestAuth protected routes with a rate limiter to slow the leak. - Restart periodically.
Fixes
- The eviction logic is corrected. - A max cache size of 1000000 is imposed to protected against a burst between evictions. This limit is not yet configurable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.http4s:http4s-ember-server_3to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-server_2.13to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-server_3to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-server_2.13to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-ember-server_2.12to a version that resolves this vulnerability.Fixed in 0.23.35 - Configuration
Set/impose the DigestAuth nonce cache max size to 1000000 to protect against burst growth between evictions.
DigestAuth server middleware max cache size = 1000000 - Compensating control
Place the DigestAuth-protected routes behind a rate limiter to slow the nonce map growth/leak during unauthenticated challenge traffic.
- Operational
Restart periodically to mitigate the persistent nonce/heap exhaustion until the eviction logic/stale-nonce cleanup is corrected.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Any service with DigestAuth enabled on at least one route is exposed. The affected endpoint can be reached remotely without authentication.
What does an attacker need to do to trigger the resource exhaustion?
An attacker only needs to cause repeated unauthenticated DigestAuth challenges, each of which creates a new nonce. No credentials, prior access, or user interaction are required.
What can be done if the fix cannot be deployed immediately?
Place rate limiting in front of routes protected by DigestAuth to slow nonce accumulation, and restart the service periodically. These measures mitigate the persistent heap growth but do not correct the faulty eviction behavior.
How does the fix reduce the risk of another nonce-cache burst?
The fix corrects the nonce eviction logic and imposes a maximum cache size of 1,000,000 entries. The cache-size limit is not configurable.