CVE-2026-69218 Details
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
A denial-of-service vulnerability has been identified in Http4s versions prior to 0.23.35 and 1.0.0-M47. When the Ember component receives an HTTP/2 HEADERS or PUSH_PROMISE frame without the END_HEADERS flag, it buffers the header block and any subsequent CONTINUATION fragments without a size limit. This allows a remote peer to keep an incomplete block open, leading to unbounded memory consumption before the request is fully processed. The issue affects both ember-server and ember-client when HTTP/2 is enabled.
Users can upgrade to Http4s versions 0.23.35 or 1.0.0-M47, where this vulnerability has been fixed. If an immediate upgrade is not possible, consider disabling HTTP/2 or using a reverse proxy that terminates HTTP/2 before it reaches the ember server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e | [email protected] | Source CodeVendor |
| https://github.com/http4s/http4s/commit/f9dcca4f5a17992ac0972fafd7920f9bc12cdc51 | [email protected] | Source CodeVendor |
| https://github.com/http4s/http4s/releases/tag/v0.23.35 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| http4s | <= 0.23.34 (semver) >= 1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
| http4s Ember Server | All versions |
CPE
Remediation
| |
| http4s Ember Client | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |