An unbounded outbound frame queue in the Ember HTTP/2 implementation of http4s allows a peer that stops reading to cause the server to enqueue acknowledgements or WINDOW_UPDATE frames faster than they are drained. This results in heap memory exhaustion, potentially terminating the server process and causing denial of service for any application configured with http4s HTTP/2 support. The flaw is a classic example of CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Abusing a Resource), and is reachable by any unauthenticated HTTP/2 client sending PING, SETTINGS, or DATA frames over a connection to a vulnerable server.

The issue affects the http4s framework, Ember HTTP/2 server and client modules, specifically versions prior to 0.23.35 and 1.0.0-M47. Any application built with http4s and enabling HTTP/2 should consider itself impacted until patched.

The vulnerability has a CVSS score of 7.5, indicating high severity for remote denial of service. The EPSS score is below 1%, reflecting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by initiating an unauthenticated HTTP/2 connection and sending PING, SETTINGS, or DATA frames that trigger the unbounded queue, eventually exhausting the server’s heap memory.