## Summary
Http4s Ember HTTP/2 handling could be abused for a heap-memory DoS. Before 0.23.35 and 1.0.0-M47, when Ember receives HEADERS or PUSH_PROMISE frames without END_HEADERS, it buffered the header block and subsequent CONTINUATION fragments without a size bound, allowing a remote peer to exhaust heap memory before request decoding.
## Technical Details
- A remote, unauthenticated peer can keep an incomplete HTTP/2 header block open by omitting END_HEADERS, then continue sending CONTINUATION fragments.
- The header-block fragments accumulated without a size bound until the connection closed, consuming heap memory.
- The fix introduces a bounded limit tied to SETTINGS_MAX_HEADER_LIST_SIZE derived from:
- EmberServerBuilder.maxHeaderSize
- EmberClientBuilder.maxResponseHeaderSize
- When the accumulated header block would exceed the computed maxHeaderBlockSize, Ember terminates the connection using GOAWAY with H2Error.EnhanceYourCalm.
- Additionally, receiveHeadersTimeout bounds how long an incomplete header block may remain open.
- Client-side changes also apply the limit to HPACK via Hpack.create(... maxHeaderListSize ...).
Detection/telemetry indicators (from patch behavior):
- Logs indicating “Header block exceeds maxHeaderListSize - Issuing GoAway”.
- Connections terminated with GOAWAY due to H2Error.EnhanceYourCalm.
## Affected
- http4s Ember HTTP/2 enabled endpoints using .withHttp2:
- ember-server configured with .withHttp2
- ember-client configured with .withHttp2
- Fixed in 0.23.35 and 1.0.0-M47.
## Impact
- Remote unauthenticated heap exhaustion (DoS) on any Ember endpoint with HTTP/2 enabled.
- Attack completes before request decoding, so even paths that return 404 can be targeted.
- For the client case, a single in-flight request to an attacker-controlled origin is sufficient.
## Mitigation
1. Upgrade http4s to versions 0.23.35 or 1.0.0-M47.
2. If immediate upgrade is not possible, disable HTTP/2 by removing/avoiding .withHttp2 (HTTP/2 is noted as off by default).
3. If HTTP/2 must remain enabled, place Ember behind a reverse proxy that terminates HTTP/2 and forwards HTTP/1.1 to Ember.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770