CVE-2026-54556

UNKNOWN 0.0

Http4s: HTTP/2 Denial of Service with Ember Backend

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CWE	CWE-409
Vendor	http4s
Product	http4s
Published	Aug 26, 2026

Stay Ahead of the Next One

Get instant alerts for http4s http4s

Be the first to know when new unknown vulnerabilities affecting http4s http4s are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

http4s / http4s

< 0.23.35 >= 1.0.0-M1, < 1.0.0-M46

org.http4s / http4s-ember-core_2.12

< 0.23.35

org.http4s / http4s-ember-core_2.13

>= 1.0.0-M1, < 1.0.0-M46 < 0.23.35

org.http4s / http4s-ember-core_3

>= 1.0.0-M1, < 1.0.0-M46 < 0.23.35

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/http4s/http4s/security/advisories/GHSA-vmm3-xgcx-67hm github.com: https://github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e github.com: https://github.com/http4s/http4s/releases/tag/v0.23.35 github.com: https://github.com/http4s/http4s/releases/tag/v1.0.0-M47