Skip to content
Threat Feed
Subscribe

Vendor

Http4s

3 briefs RSS
medium threat

http4s Ember Backend HTTP/2 HPACK Bomb Denial of Service

The http4s Ember backend is vulnerable to a denial of service attack via HPACK bomb due to improper header size accounting, allowing remote attackers to trigger Java heap memory exhaustion.

exploited http4s-ember-core
medium advisory

Unbounded WebSocket Message Aggregation Leads to Denial of Service in http4s-blaze-server

A vulnerability in `http4s-blaze-server` allows an attacker to cause a denial of service by exploiting unbounded WebSocket message aggregation, enabling an attacker to drive unbounded heap growth in the server's JVM by sending an unterminated fragmented WebSocket message, leading to an `OutOfMemoryError` and server termination, affecting any http4s application serving WebSocket routes over `BlazeServerBuilder` and triggerable by unauthenticated or authenticated clients.

http4s-blaze-server_2.13 +3 denial-of-service webserver jvm websocket
1t
high advisory

Multiple HTTP/1.1 Request Smuggling Primitives in Blaze Java Parser

Five independent HTTP/1.1 conformance laxities in Blaze's Java parser cause request-boundary disagreement with a stricter intermediary proxy, enabling front-end ACL/authentication bypass, response-queue poisoning on pooled backend connections, and cache poisoning in affected `http4s-blaze-server` and `blaze-http` components.

http4s-blaze-server_2.13 +2 request-smuggling http/1.1 java vulnerability
2t