A host‑driven HTTP/2 client or server can send data faster than the application consumes it, because Ember replenishes the flow‑control window based on receipt rather than consumption and stores each stream’s payload in an un heap allocation that can grow without bound, leading to severe memory exhaustion or application crashes. The weakness is reflected in CWE‑400 and CWE‑770.

Versions of http4s Ember prior to 0.23.35 and 1.0.0-M47 are affected. Both the server and client components that enable HTTP/2 with withHttp2 may be vulnerable.

The CVSS score of 7.5 indicates high severity, and the EPSS score of <1% indicates a very low exploitation probability. This vulnerability has not been listed in CISA’s KEV catalog. An attacker can exploit this by initiating a hydra‑style upload to a target that accepts HTTP/2 traffic, causing memory pressure that may render the service unavailable.