CVE-2026-69202 Details
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
A denial-of-service vulnerability has been identified in Http4s versions prior to 0.23.35 and 1.0.0-M47. The issue arises in Ember's HTTP/2 implementation, where the flow-control window is replenished based on bytes received from the network, rather than bytes consumed by the application. This flaw allows a malicious peer to send data faster than a slow or non-draining application can process it, leading to unbounded payload accumulation in memory on servers or clients using HTTP/2. The vulnerability is particularly impactful on routes that do not efficiently drain request bodies.
Users can upgrade to Http4s versions 0.23.35 or 1.0.0-M47, both of which include the necessary fix. Alternatively, HTTP/2 can be disabled to eliminate the vulnerability, or an aggregate request-entity size limit can be applied on routes that consume the body. Ensuring that handlers fully drain request bodies, especially on routes with aggressive idle timeouts, can also help mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4s/http4s/commit/22d2335975d02dc9fb9fb75cfe002279521d86ac | [email protected] | Source CodeVendor |
| https://github.com/http4s/http4s/releases/tag/v0.23.35 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 | [email protected] | BundleRelease NotesVendor |
| https://github.com/http4s/http4s/security/advisories/GHSA-6m4x-pp6q-5jmm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| http4s | <= 0.23.34 (semver) ~1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
| http4s-ember-core | <= 0.23.34 (semver) ~1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | New CVE Received | [email protected] |
| Sep 15, 2026 | CVE Modified | CISA-ADP |