AIKIDO-2026-885474
http4s-ember-core_2.12 is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
http4s-ember-core_2.12TL;DR
Ember's HTTP/2 SETTINGS frame parser only checks that the payload length is a multiple of 6 bytes and places no cap on how many setting entries it decodes. A peer can send one large SETTINGS frame, up to about 16 MiB, that expands into millions of in-memory setting objects, producing roughly 13x memory amplification, and a handful of concurrent connections doing this can exhaust a typical JVM heap. The fix caps the number of settings entries accepted per frame.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable Ember's HTTP/2 support (enableHttp2/withHttp2).
Background info
http4s-ember-core_2.12 is vulnerable to Denial of Service (DoS) in versions 0.23.9 - 0.23.36.
How to fix this
Upgrade the org.http4s:http4s-ember-core_2.12 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.