CVE-2026-69218

HIGH 7.5

Http4s Ember HTTP/2: unbounded continuation frame accumulation

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CWE	CWE-770
Vendor	http4s
Product	http4s
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for http4s http4s

Be the first to know when new high vulnerabilities affecting http4s http4s are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

http4s / http4s

< 0.23.35 >= 1.0.0-M1, < 1.0.0-M47

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6 github.com: https://github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e github.com: https://github.com/http4s/http4s/commit/f9dcca4f5a17992ac0972fafd7920f9bc12cdc51 github.com: https://github.com/http4s/http4s/releases/tag/v0.23.35 github.com: https://github.com/http4s/http4s/releases/tag/v1.0.0-M47