CVE-2026-69203: Http4s Ember HTTP/2 stream limit enforcement bypass

CVE-2026-69203 · Severity: high · CVSS 7.5 · Published 2026-09-15

Http4s Ember is a Scala HTTP library that handles web traffic. When HTTP/2 is enabled on an Ember server or client, it fails to enforce the negotiated maximum number of concurrent streams, allowing an attacker to open unlimited streams and exhaust the server's memory, causing a service outage. This is an unauthenticated remote denial-of-service attack requiring only network access to the affected service.

Technologies: Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven), org.http4s:http4s-ember-core_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-69203 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69203 being exploited in the wild.
How severe is CVE-2026-69203?
High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?
Http4s-Ember-Core <= 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.
Is there a fix for CVE-2026-69203?
Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69203 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69203?
Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-770) in the HTTP/2 implementation of Http4s Ember. The root cause is that the library does not enforce the SETTINGS_MAX_CONCURRENT_STREAMS parameter negotiated during HTTP/2 handshake. An unauthenticated attacker can open an unbounded number of concurrent streams over a single connection; each stream allocates per-stream server state that is never released, leading to heap exhaustion and denial of service. The same vulnerability affects Ember clients via malicious server-initiated PUSH_PROMISE frames. This is part of the HTTP/2 "Rapid Reset" family of attacks (CVE-2023-44487). Attack vector is network, requires no authentication or user interaction, and affects only systems with `.withHttp2` enabled. Patches are available in Http4s 0.23.35 and 1.0.0-M47.

Affected products

  • http4s http4s-ember-core_2.12 <= 0.23.34
  • http4s http4s-ember-core_2.13 <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46
  • http4s http4s-ember-core_3 <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46

Identifiers

  • CVE-2026-69203
  • GHSA-9vwc-pc8p-253q

Timeline

  • 2026-09-15: disclosed: Published to GitHub Advisory Database
  • 2026-09-15: patched: Patches released in versions 0.23.35 and 1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.