# CVE-2026-69213: Http4s Ember HTTP/2 unbounded outbound frame queue denial of service Source: https://junglewise.ai/threats/cve-2026-69213-http4s-ember-http-2-unbounded-outbound-frame-queue-denial-of Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-15. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-69213 · Severity: high · CVSS 7.5 · Published 2026-09-15 Http4s Ember is a Scala HTTP server and client library with HTTP/2 support. The HTTP/2 implementation uses an unbounded queue for outgoing network frames, which can grow without limit when the network write side stalls. An unauthenticated attacker can send inexpensive control frame requests to trigger automatic responses from the server or client, causing the queue to fill and exhaust available memory, crashing the process. This results in service outage with minimal attacker effort. Technologies: [Http4s-Ember-Core](https://junglewise.ai/threats/technologies/http4s-ember-core), [org.http4s:http4s-ember-core_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-12), [org.http4s:http4s-ember-core_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-13), [org.http4s:http4s-ember-core_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven). ## Quick answers **Is CVE-2026-69213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69213 being exploited in the wild. **How severe is CVE-2026-69213?** High severity, with a CVSS score of 7.5, published 15 September 2026. **Which products and versions are affected?** Http4s-Ember-Core <=0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35. **Is there a fix for CVE-2026-69213?** Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-69213 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-69213?** Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later ```sh # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle ``` - org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later ```sh # set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle ``` - org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later ```sh # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle ``` ## Technical details The vulnerability is an unbounded resource consumption issue (CWE-400, CWE-770) in the Ember HTTP/2 connection handler. Outgoing frames are serialized through a single unbounded queue (`writeLoop` fiber) without flow control limits. When the network write side stalls or slows, legitimate frame production accumulates indefinitely in memory. An attacker can cheaply trigger automatic control frame responses (PING ACK, SETTINGS ACK, WINDOW_UPDATE) by sending unauthenticated control frames; the peer will generate matching responses without bounds. This affects both Ember servers (attacked by malicious clients) and Ember clients (attacked by malicious or compromised servers that send data and stall reading ACKs). A single connection can exhaust heap and trigger out-of-memory (OOM) crashes. Patches are available: versions 0.23.35 and 1.0.0-M47 and later bound the queue size. Workaround: disable HTTP/2 by not calling `.withHttp2()`. ## Affected products - http4s http4s-ember-core <=0.23.34 - http4s http4s-ember-core >=1.0.0-M1, <=1.0.0-M46 ## Identifiers - CVE-2026-69213 - GHSA-8f3q-3jmv-7prw ## Timeline - 2026-09-15: disclosed: Published to GitHub Advisory Database - 2026: patched: Patched in versions 0.23.35 and 1.0.0-M47 ## References - [https://api.github.com/users/reardonj](https://api.github.com/users/reardonj) - [https://github.com/reardonj](https://github.com/reardonj) - [https://api.github.com/users/reardonj/gists%7B/gist_id%7D](https://api.github.com/users/reardonj/gists%7B/gist_id%7D) - [https://api.github.com/users/reardonj/repos](https://api.github.com/users/reardonj/repos) - [https://avatars.githubusercontent.com/u/142968?v=4](https://avatars.githubusercontent.com/u/142968?v=4) - [https://api.github.com/users/reardonj/events%7B/privacy%7D](https://api.github.com/users/reardonj/events%7B/privacy%7D) ## Related threats - [Http4s Ember HTTP/2 frame buffering denial of service](https://junglewise.ai/threats/cve-2026-88975-http4s-ember-http-2-frame-buffering-denial-of-service) - [Http4s Ember HTTP/2 unbounded continuation frame accumulation](https://junglewise.ai/threats/cve-2026-69218-http4s-ember-http-2-unbounded-continuation-frame-accumulation) - [Http4s DigestAuth replay attack in authorization header](https://junglewise.ai/threats/cve-2026-69206-http4s-digestauth-replay-attack-in-authorization-header) - [Http4s Ember HTTP request smuggling via Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2026-69205-http4s-ember-http-request-smuggling-via-transfer-encoding-parsing) - [Http4s Ember HTTP/2 stream limit enforcement bypass](https://junglewise.ai/threats/cve-2026-69203-http4s-ember-http-2-stream-limit-enforcement-bypass)