module for HTTP/2. A flaw allows a remote peer to send a HEADERS or PUSH_PROMISE frame without the END_HEADERS flag. Ember buffers all header fragments without enforcing a size limit. An attacker can keep an incomplete header block open, draining the JVM heap before request decoding. This results in a denial‑of‑service condition without code‑execution or data‑exfiltration capability.

The vulnerability affects the http4s library across both server and client implementations. Versions prior to 0.23.35 and 1.0.0‑M47 that enable HTTP/2 via withHttp2 are impacted. Upgrading to a bounded buffer that enforces SETTINGS_MAX_HEADER_LIST_SIZE and sends a GOAWAY when the limit is exceeded mitigates the issue.

The CVSS score of 7.5 indicates. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network connection to the affected ember server or client; no privileged access or authentication is required. The effect is limited to the targeted traffic, but can precipitate widespread outages.