CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
| CWE | CWE-400 CWE-770 |
| Vendor | http4s |
| Product | http4s |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Get instant alerts for http4s http4s
Be the first to know when new high vulnerabilities affecting http4s http4s are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H