| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.http4s:http4s-ember-core_2.12 | < 0.23.35 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13 | ≥ 1.0.0-M1, < 1.0.0-M47< 0.23.35 | 1.0.0-M470.23.35 |
| org.http4s:http4s-ember-core_3 | ≥ 1.0.0-M1, < 1.0.0-M47< 0.23.35 | 1.0.0-M470.23.35 |
An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.
Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).
The same unchecked allocation path is reachable on the client via server-initiated PUSH_PROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.
.withHttp2 enabled.enablePush is not enforced.EmberServerBuilder or EmberClientBuilder (default)これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン