CVE-2026-69202
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
How to fix
- org.http4s:http4s-ember-core_2.120.23.35 or later
- org.http4s:http4s-ember-core_2.130.23.35, 1.0.0-M47 or later
- org.http4s:http4s-ember-core_30.23.35, 1.0.0-M47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.http4s:http4s-ember-core_2.12Maven | v < 0.23.35 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| org.http4s:http4s-ember-core_3Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.