CVE-2026-88975High· 7.5▾ TwilightHttp4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An u…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.http4s:http4s-ember-core_2.13 <= 0.23.36org.http4s:http4s-ember-core_2.12 <= 0.23.36org.http4s:http4s-ember-core_3 <= 0.23.36org.http4s:http4s-ember-core_2.13 >= 1.0.0-M1, <= 1.0.0-M47org.http4s:http4s-ember-core_3 >= 1.0.0-M1, <= 1.0.0-M47Patched in:
org.http4s:http4s-ember-core_2.13 0.23.37org.http4s:http4s-ember-core_2.12 0.23.37org.http4s:http4s-ember-core_3 0.23.37org.http4s:http4s-ember-core_2.13 1.0.0-M48org.http4s:http4s-ember-core_3 1.0.0-M48Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69213High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69208High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69209High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69218High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69206Medium· 5.9Http4s is a Scala interface for HTTP services
CVE-2026-69203High· 7.5Http4s is a Scala interface for HTTP services