| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.http4s:http4s-ember-core_2.12 | < 0.23.35 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13 | ≥ 1.0.0-M1, < 1.0.0-M47< 0.23.35 | 1.0.0-M470.23.35 |
| org.http4s:http4s-ember-core_3 | ≥ 1.0.0-M1, < 1.0.0-M47< 0.23.35 | 1.0.0-M470.23.35 |
An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.
Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).
The same unchecked allocation path is reachable on the client via server-initiated PUSH_PROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.
.withHttp2 enabled.enablePush is not enforced.EmberServerBuilder or EmberClientBuilder (default)Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí