AIKIDO-2026-791687
http4s-ember-core_2.12 is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
http4s-ember-core_2.12TL;DR
Ember's HTTP/2 connection-level write flow control waits on s.writeBlock.get.rethrow for a WINDOW_UPDATE frame from the peer, but the connection idle-timeout check sits after that wait, so the check never fires if the peer simply never sends one. A single well-formed HTTP/2 request lets a peer stall the write side of an Ember HTTP/2 connection permanently, and repeating this up to the default connection limit can stop the server from accepting new connections. The stream-level write path already wrapped its wait in a timeout; the connection-level path did not. The fix wraps the connection-level write wait in the same stall-timeout guard.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable Ember's HTTP/2 support (enableHttp2/withHttp2).
Background info
http4s-ember-core_2.12 is vulnerable to Denial of Service (DoS) in versions 0.23.9 - 0.23.36.
How to fix this
Upgrade the org.http4s:http4s-ember-core_2.12 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.