Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.
Impact
Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).
The same unchecked allocation path is reachable on the client via server-initiated PUSH_PROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.
Preconditions
- Server: with
.withHttp2enabled. - Client: makes HTTP/2 requests to malicious or compromised sites.
enablePushis not enforced.
Workarounds
- Disable HTTP/2 on
EmberServerBuilderorEmberClientBuilder(default) - Client only: avoid HTTP/2 to untrusted servers until patched.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_2.12 | < 0.23.35 | 0.23.35 |
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_2.13 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| Java / Kotlin (Maven) | org.http4s:http4s-ember-core_3 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-400, CWE-770- Platform
- Java / Kotlin (Maven)
- Package
org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13, org.http4s:http4s-ember-core_3- Disclosed
- 15.09.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9vwc-pc8p-253q - CC BY 4.0
Vulnerability history: org.http4s:http4s-ember-core_2.13
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 09.2025 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 7
- Medium 3
Disclosures per year
- 2025: 1
- 2026: 10
-
Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.