Http4s, a Scala HTTP service library, contains a flaw in the Ember backend’s HTTP/2 implementation that allows an attacker to trigger an out-of-memory denial of service. The vulnerability arises because the Hpack wrapper fails to account for indexed headers and per-header overhead when calculating the maximum header size, permitting a small compressed header block to balloon into an excessively large decoded representation consuming heap space. Abuse of this weakness can cause the server to crash or become unresponsive.

Affected systems include all versions of Http4s before 0.23.35 and the 1.0.0-M47 release. The product families impacted are the main Http4s library and the Ember backend modules for Scala 2.12, 2.13, and 3, all of which are publicly available on GitHub. Administrators should verify that their deployments still rely on a vulnerable version and be aware that untrusted clients could connect to exposed HTTP/2 services.

Risk assessment indicates a CVSS score of 8.2, signaling high severity. The exploit probability is not quantified (EPSS not available), and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by sending crafted HTTP/2 requests without authentication, and multiple concurrent connections may overwhelm the server’s heap, causing sustained disruption.