CVE-2026-54556: http4s HTTP/2 denial of service in HPACK header compression

CVE-2026-54556 · Severity: high · CVSS 4 · Published 2026-08-26

http4s is a popular Scala HTTP framework. When configured to use the Ember backend with HTTP/2, the library decodes compressed headers without enforcing a size limit on the decompressed data. An attacker can send specially crafted header frames that expand dramatically when decoded, exhausting server memory and causing denial of service. This affects any exposed http4s service or client that connects to untrusted servers.

Technologies: Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven), org.http4s:http4s-ember-core_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-54556 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54556 being exploited in the wild.
How severe is CVE-2026-54556?
High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?
Http4s-Ember-Core 0.23.x <= 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=1.0.0-M1,fixed=1.0.0-M47; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.
Is there a fix for CVE-2026-54556?
Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 1.0.0-M47 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54556 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54556?
Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 1.0.0-M47 or later
    # set org.http4s:http4s-ember-core_2.13 to 1.0.0-M47 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle

Technical details

The vulnerability is a data amplification (HPACK bomb) flaw in the Ember backend's HTTP/2 header handling code. The issue occurs because Ember concatenates header and continuation frames, then decompresses all headers at once using HPACK. The maxHeaderSize configuration parameter does not account for indexed headers during decompression, allowing attackers to bypass the limit. Small compressed payloads decompress to significantly larger data structures held in memory as a single List, causing OutOfMemoryError with approximately 5 concurrent connections on a 2GB heap. The vulnerable component is org.http4s:http4s-ember-core (versions ≤0.23.34 and 1.0.0-M1 to 1.0.0-M46). A patch threads the maxHeaderSize parameter through the HPACK decoder to enforce size limits on decompressed data. Upgrades to 0.23.35 or 1.0.0-M47+ resolve the issue; workaround is to disable HTTP/2.

Affected products

  • http4s http4s-ember-core 0.23.x <= 0.23.34
  • http4s http4s-ember-core 1.0.0-M1 to 1.0.0-M46

Identifiers

  • CVE-2026-54556
  • GHSA-vmm3-xgcx-67hm

Timeline

  • 2026-07-06: disclosed: Published to GitHub Advisory Database
  • 2026-08-26: advisory: GitHub reviewed and updated advisory
  • 2026-08-26: patched: Patches released: 0.23.35 and 1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.