CVE-2026-69213
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause Ember to enqueue acknowledgments or WINDOW_UPDATE frames faster than the writer drains them, exhausting heap memory on a server built with withHttp2. The shared behavior also affects an ember-client connected to a hostile HTTP/2 server, and the patch replaces the unbounded path with bounded, backpressured outbound queues. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
How to fix
- org.http4s:http4s-ember-core_2.120.23.35 or later
- org.http4s:http4s-ember-core_2.130.23.35, 1.0.0-M47 or later
- org.http4s:http4s-ember-core_30.23.35, 1.0.0-M47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.http4s:http4s-ember-core_2.12Maven | v < 0.23.35 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| org.http4s:http4s-ember-core_3Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.