CVE-2026-88975
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.
How to fix
- org.http4s:http4s-ember-core_2.130.23.37, 1.0.0-M48 or later
- org.http4s:http4s-ember-core_2.120.23.37 or later
- org.http4s:http4s-ember-core_30.23.37, 1.0.0-M48 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.http4s:http4s-ember-core_2.13Maven | v < 0.23.37, 1.0.0-M1 ≤ v < 1.0.0-M48 | 0.23.37, 1.0.0-M48 |
| org.http4s:http4s-ember-core_2.12Maven | v < 0.23.37 | 0.23.37 |
| org.http4s:http4s-ember-core_3Maven | v < 0.23.37, 1.0.0-M1 ≤ v < 1.0.0-M48 | 0.23.37, 1.0.0-M48 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.