Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.
Patches
Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.
Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:
libraryDependencies ++= Seq(
"io.netty" % "netty-codec" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-codec-socks" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler-proxy" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-common" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-transport" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-handler" % "4.1.53.Final" % Runtime,
"io.netty" % "netty-resolver-dns" % "4.1.53.Final" % Runtime
)References
For more information
If you have any questions or comments about this advisory:
- Open an issue in http4s
- Contact a maintainer privately per http4s' security policy
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4s:http4s-async-http-client_2.12 | < 0.21.8 | 0.21.8 |
| Java / Kotlin (Maven) | org.http4s:http4s-async-http-client_2.13 | < 0.21.8 | 0.21.8 |
References
- Weakness (CWE)
CWE-400- Platform
- Java / Kotlin (Maven)
- Package
org.http4s:http4s-async-http-client_2.12, org.http4s:http4s-async-http-client_2.13- Disclosed
- 16.10.2020
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8hxh-r6f7-jf45 - CC BY 4.0
Vulnerability history: org.http4s:http4s-async-http-client_2.13
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.