GHSA-8hxh-r6f7-jf45
Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
GHSA-8hxh-r6f7-jf45 is a vulnerability with no CVSS score yet in org.http4s:http4s-async-http-client_2.13, published October 16, 2020. No source lists public exploit code. Fixed in org.http4s:http4s-async-http-client_2.13 0.21.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.21.8org.http4s:http4s-async-http-client_2.13 +3 more
Description
Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.
Patches
Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.
Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:
libraryDependencies ++= Seq(
"io.netty" % "netty-codec" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-codec-socks" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler-proxy" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-common" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-transport" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-resolver-dns" % "4.1.53.Final" % Runtime
)
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in http4s
- Contact a maintainer privately per http4s' security policy
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.http4s:http4s-async-http-client_2.13Maven | through 0.21.7 | 0.21.8 |
org.http4s:http4s-async-http-client_2.12Maven | through 0.21.7 | 0.21.8 |
org.http4s:http4s-async-http-client_2.13Maven | before 0.21.8, plus listed versions 0.10.0-M100.21.00.21.0-M10.21.0-M20.21.0-M3 Show 15 moreShow less0.21.0-M40.21.0-M50.21.0-M60.21.0-RC10.21.0-RC20.21.0-RC30.21.0-RC40.21.0-RC50.21.10.21.20.21.30.21.40.21.50.21.60.21.7 | 0.21.8 |
org.http4s:http4s-async-http-client_2.12Maven | before 0.21.8, plus listed versions 0.10.0-M100.15.00.15.0a0.15.10.15.10 Show 45 moreShow less0.15.10a0.15.110.15.11a0.15.120.15.12a0.15.130.15.13a0.15.140.15.14a0.15.150.15.15a0.15.160.15.16a0.15.1a0.15.20.15.2a0.15.30.15.3a0.15.40.15.4a0.15.50.15.5a0.15.60.15.6a0.15.70.15.7a0.15.80.15.8a0.15.90.15.9a0.16.00.16.0-M10.16.0-M20.16.0-M30.16.0-RC10.16.0-RC20.16.0-RC30.16.0a0.16.0a-M10.16.0a-M20.16.0a-M30.16.0a-RC10.16.0a-RC20.16.0a-RC30.16.1 | 0.21.8 |
What each source reports
GitHub AdvisoriesNo score
Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.
Patches
Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.
Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:
libraryDependencies ++= Seq(
"io.netty" % "netty-codec" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-codec-socks" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler-proxy" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-common" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-transport" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-resolver-dns" % "4.1.53.Final" % Runtime
)
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in http4s
- Contact a maintainer privately per http4s' security policy
- Record
GHSA-8hxh-r6f7-jf45- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.
Patches
Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.
Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:
libraryDependencies ++= Seq(
"io.netty" % "netty-codec" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-codec-socks" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler-proxy" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-common" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-transport" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-resolver-dns" % "4.1.53.Final" % Runtime
)
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in http4s
- Contact a maintainer privately per http4s' security policy
- Record
GHSA-8hxh-r6f7-jf45- Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 115 versions. The JSON record has them.