CVE-2026-54556High▾ TwilightHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.http4s:http4s-ember-core_2.12 <= 0.23.34org.http4s:http4s-ember-core_2.13 >= 1.0.0-M1, < 1.0.0-M46org.http4s:http4s-ember-core_3 <= 0.23.34org.http4s:http4s-ember-core_3 >= 1.0.0-M1, < 1.0.0-M46org.http4s:http4s-ember-core_2.13 <= 0.23.34Patched in:
org.http4s:http4s-ember-core_2.12 0.23.35org.http4s:http4s-ember-core_2.13 1.0.0-M47org.http4s:http4s-ember-core_3 0.23.35org.http4s:http4s-ember-core_3 1.0.0-M47org.http4s:http4s-ember-core_2.13 0.23.35Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69218High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69202High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69203High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69215Medium· 6.8Http4s is a Scala interface for HTTP services
CVE-2026-69206Medium· 5.9Http4s is a Scala interface for HTTP services
CVE-2026-69205High· 8.7Http4s is a Scala interface for HTTP services