Http4s Ember HTTP/2: unbounded inbound body buffering
Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body faster than the application drains it and the connection retains every payload in heap.
This is the read-path mirror of the outbound queue issue.
This affects an Ember receiving a request body and an Ember client receiving a response body from a hostile server.
Impact
Unauthenticated remote denial of service (OOM) against any Ember server built
.withHttp2 for a non-draining or slow-draining route, and against an Ember client consuming from a hostile or compromised server.
Workarounds
- Disable HTTP/2 to remove the vector entirely.
- Apply an aggregate request-entity size limit (e.g.
EntityLimitermiddleware) on routes that consume the body. - Ensure handlers fully drain request bodies with aggressive idle timeouts.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_2.12 | < 0.23.35 | 0.23.35 |
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_2.13 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_3 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400, CWE-770- Platform
- Java / Kotlin (Maven)
- Package
org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13, org.http4s:http4s-ember-core_3- Disclosed
- 15.09.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6m4x-pp6q-5jmm - CC BY 4.0
Vulnerability history: org.http4s:http4s-ember-core_2.13
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 09.2025 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 7
- Medium 3
Disclosures per year
- 2025: 1
- 2026: 10
-
Http4s Ember HTTP/2: unbounded inbound body buffering this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.