Memory exhaustion vulnerability in http4s-async-http-client
Summary
GHSA-8hxh-r6f7-jf45: Memory exhaustion in http4s-async-http-client with large or malicious compressed responses. Affects org.http4s:http4s-async-http-client_2.13 versions < 0.21.8. Fixed in 0.21.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The http4s-async-http-client is a library used for making HTTP requests in Scala applications. It provides an asynchronous and non-blocking API for sending and receiving HTTP messages. The library relies on the netty-codec library for handling compressed responses. However, a vulnerability has been discovered in the library that could lead to memory exhaustion in the client JVM when processing large or malicious compressed responses.
Vulnerability Detail
The vulnerability arises from a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612. An attacker could exploit this vulnerability by sending a large or malicious compressed stream as a response to a request made using http4s-async-http-client. This could cause the client JVM to exhaust its memory resources, potentially leading to denial of service or other adverse effects. It is important to note that this vulnerability only affects clients that connect to untrusted servers.
How To Fix
Latest published version: 1.0-234-d1a2b53 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.21.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or adding explicit dependencies is not feasible, there is no specific workaround mentioned for this vulnerability.
Conclusion
The memory exhaustion vulnerability in http4s-async-http-client can be mitigated by upgrading to version 0.21.8 or higher. Alternatively, explicit dependencies on unaffected versions of the netty libraries can be added. It is important to promptly address this vulnerability to prevent potential denial of service or other adverse effects. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.http4s:http4s-async-http-client_2.13 →
FAQ
Versions up to and including 0.21.7 of http4s-async-http-client are affected by this vulnerability.
No, this vulnerability only affects clients that use http4s-async-http-client to connect to untrusted servers.
There are no known exploits for this vulnerability at the time of this advisory.
No, a CVSS score is not provided for this vulnerability.
You can find more information about this vulnerability in the references section of this advisory.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
