An Ember HTTP/2 server that does not enforce the SETTINGS_MAX_CONCURRENT_STREAMS frame allows an unauthenticated peer to open an unbounded number of streams. Each stream consumes per-stream state; if many streams are opened, the JVM heap can be exhausted. The same unchecked allocation is also reachable in an Ember client via server-initiated PUSH_PROMISE frames when push is not enabled. The result is a denial of service that can crash or degrade the affected application.

The vulnerability affects the http4s Ember HTTP/2 stack. Any deployment of Http4s Ember server or client running a version earlier than 0.23.35 or 1.0.0-M47 is susceptible.

The CVSS score of 7.5 indicates a moderate-to-high severity. The EPSS score is about 0.5%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw over an unauthenticated HTTP/2 connection, creating multiple simultaneous streams to exhaust memory. The presence of the flaw in both server and client amplifies the attack surface, making remediation via patching the single most effective measure.