AIKIDO-2026-785372
http4s-ember-server_2.12 is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
http4s-ember-server_2.12TL;DR
Ember's h2c upgrade path reads an entire incoming HTTP/1.1 request body into memory via req.body.compile.to(ByteVector) before handing the connection to the H2 layer, and this buffering runs ahead of the application's own body-size limits since the upgrade middleware sits in front of the user's httpApp. A single HTTP/1.1 request with h2c upgrade headers and a large body lets a peer exhaust server memory and crash the process. The fix removes h2c upgrade support entirely, so connections now degrade to plain HTTP/1.1 instead of buffering toward an upgrade.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable Ember's HTTP/2 cleartext (h2c) upgrade support (enableHttp2/withHttp2).
Background info
http4s-ember-server_2.12 is vulnerable to Denial of Service (DoS) in versions 0.23.9 - 0.23.36.
How to fix this
Upgrade the org.http4s:http4s-ember-server_2.12 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.