## Summary
Http4s Ember HTTP/2 servers that enable HTTP/2 via .withHttp2 do not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams prior to 0.23.35 and 1.0.0-M47. A single unauthenticated connection can open an unbounded number of streams, retaining per-stream server state until heap exhaustion (remote memory DoS).
## Technical Details
- Root issue: missing enforcement of HTTP/2 stream concurrency limits (SETTINGS_MAX_CONCURRENT_STREAMS) for peer-created streams when HTTP/2 is enabled.
- Attack behavior: one unauthenticated connection can create unbounded concurrent streams; each stream allocates per-stream server state that is not released, leading to heap exhaustion.
- Client-side reachability: the same unchecked allocation path is reachable in an ember-client when the server sends PUSH_PROMISE frames; enablePush is not enforced.
- Fix evidence: the upstream change introduces a maxStreams: Semaphore[F] gate in H2Server stream processing (processCreatedStream / processCreatedStreams), and uses rstStream with H2Error.RefusedStream when limits are exceeded.
## Affected
- http4s Ember HTTP/2 server: versions prior to 0.23.35 when using .withHttp2.
- http4s Ember HTTP/2 client: versions prior to 1.0.0-M47 when server-initiated PUSH_PROMISE handling is reachable and enablePush is not enforced.
## Impact
- Unauthenticated remote denial of service via memory exhaustion (heap exhaustion) against Ember HTTP/2 servers.
- Resource-exhaustion class consistent with the HTTP/2 “Rapid Reset” family (referenced as CVE-2023-44487).
- Potential client impact: a malicious/compromised server can exhaust an ember-client heap via PUSH_PROMISE.
## Mitigation
1. Upgrade http4s to versions 0.23.35 or 1.0.0-M47 (fix included).
2. If upgrade is not immediately possible, disable HTTP/2 on EmberServerBuilder and/or EmberClientBuilder.
3. For clients: avoid HTTP/2 to untrusted servers until patched.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-400