https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:16:25 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-69202 <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> https://db.gcve.eu/vuln/fkie_cve-2026-69202 https://db.gcve.eu/vuln/ghsa-6m4x-pp6q-5jmm <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>Ember&#39;s HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body faster than the application drains it and the connection retains every payload in heap.</p> <p>This is the read-path mirror of the [outbound queue issue](https://github.com/http4s/http4s/security/advisories/GHSA-8f3q-3jmv-7prw).</p> <p>This affects an Ember receiving a request body and an Ember client receiving a response body from a hostile server.</p> <p>### Impact</p> <p>Unauthenticated remote denial of service (OOM) against any Ember server built `.withHttp2` for a non-draining or slow-draining route, and against an Ember client consuming from a hostile or compromised server.</p> <p>### Workarounds</p> <p>- Disable HTTP/2 to remove the vector entirely. - Apply an aggregate request-entity size limit (e.g. `EntityLimiter` middleware) on routes that consume the body. - Ensure handlers fully drain request bodies with aggressive idle timeouts.</p> <p><strong>Affected:</strong> Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3</p> <p>Ember&#39;s HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body faster than the application drains it and the connection retains every payload in heap.</p> <p>This is the read-path mirror of the [outbound queue issue](https://github.com/http4s/http4s/security/advisories/GHSA-8f3q-3jmv-7prw).</p> <p>This affects an Ember receiving a request body and an Ember client receiving a response body from a hostile server.</p> <p>### Impact</p> <p>Unauthenticated remote denial of service (OOM) against any Ember server built `.withHttp2` for a non-draining or slow-draining route, and against an Ember client consuming from a hostile or compromised server.</p> <p>### Workarounds</p> <p>- Disable HTTP/2 to remove the vector entirely. - Apply an aggregate request-entity size limit (e.g. `EntityLimiter` middleware) on routes that consume the body. - Ensure handlers fully drain request bodies with aggressive idle timeouts.</p> https://db.gcve.eu/vuln/ghsa-6m4x-pp6q-5jmm