# CVE-2026-69209: http4s WebSocket decoder unbounded message buffering

Source: https://junglewise.ai/threats/cve-2026-69209-http4s-websocket-decoder-unbounded-message-buffering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-69209 · Severity: high · CVSS 7.5 · Published 2026-09-15

http4s is a Scala web services framework that handles WebSocket connections. A flaw in its WebSocket decoder allows remote clients to exhaust server memory by sending oversized or fragmented messages without limits, causing service outages. This affects http4s-blaze-server and http4s-ember-server deployments exposed to untrusted network clients.

Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s).

## Quick answers

**Is CVE-2026-69209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69209 being exploited in the wild.

**How severe is CVE-2026-69209?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** Http4s-Blaze-Server prior to 0.23.35; Http4s-Ember-Server prior to 0.23.35 and prior to 1.0.0-M47.

**Is there a fix for CVE-2026-69209?** A patch was published on 2026-06-29: Fix committed to http4s repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69209?** Check whether you run Http4s-Blaze-Server or Http4s-Ember-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unbounded resource consumption flaw in the WebSocket frame decoder. The root cause is twofold: the defragmentation logic accumulates message fragments without enforcing a size limit, and the FrameTranscoder accepts declared frame lengths up to Int.MaxValue. A remote attacker who completes a WebSocket handshake can send oversized frames or fragmented messages to trigger uncontrolled memory buffering. No authentication is required; the attack is triggered via network access to a WebSocket endpoint. The fix applies a configurable 64 MiB default limit per frame and defragmented message through EmberServerBuilder.withMaxWebSocketMessageSize, available in versions 0.23.35 and 1.0.0-M47.

## Affected products

- http4s http4s-blaze-server prior to 0.23.35
- http4s http4s-ember-server prior to 0.23.35 and prior to 1.0.0-M47

## Timeline

- 2026-09-15: disclosed: Public disclosure via NVD
- 2026-06-29: patched: Fix committed to http4s repository
- 2026-07-06: patched: Released in v0.23.35

## References

- [https://github.com/http4s/http4s/commit/d578c3c9da6193627d40fa785e612cda7fcd77b3](https://github.com/http4s/http4s/commit/d578c3c9da6193627d40fa785e612cda7fcd77b3)
- [https://github.com/http4s/http4s/releases/tag/v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)

## Related threats

- [Http4s DigestAuth memory exhaustion via unbounded nonce cache](https://junglewise.ai/threats/cve-2026-69208-http4s-digestauth-memory-exhaustion-via-unbounded-nonce-cache)