CVE-2026-69218: Http4s Ember HTTP/2 unbounded continuation frame accumulation

CVE-2026-69218 · Severity: high · CVSS 7.5 · Published 2026-09-15

Http4s Ember is a Scala HTTP library that supports HTTP/2 protocol. When HTTP/2 is enabled, an unauthenticated remote attacker can send specially crafted header frames that cause the server or client to accumulate data in memory without bounds, eventually exhausting heap memory and crashing the service. For servers, this attack requires only an ability to reach the HTTP/2 endpoint; for clients, a malicious server can trigger the issue.

Technologies: Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven), org.http4s:http4s-ember-core_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-69218 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69218 being exploited in the wild.
How severe is CVE-2026-69218?
High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?
Http4s-Ember-Core <= 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.
Is there a fix for CVE-2026-69218?
Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69218 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69218?
Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle

Technical details

The vulnerability is a resource exhaustion flaw (CWE-770) in Http4s Ember's HTTP/2 implementation. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without the END_HEADERS flag, it buffers the header block fragment and waits for CONTINUATION frames. If an attacker sends many CONTINUATION frames without completing the header block, these fragments accumulate unbounded until the connection closes. For ember-server with .withHttp2 enabled, any HTTP/2 client can trigger this against any path with no authentication required. For ember-client, a malicious origin server can trigger it via response headers. The fix bounds accumulated header-block size at SETTINGS_MAX_HEADER_LIST_SIZE and terminates the connection with GOAWAY when that limit is exceeded. Patches are available in version 0.23.35 and 1.0.0-M47.

Affected products

  • http4s http4s-ember-core <= 0.23.34
  • http4s http4s-ember-core (1.0.0 series) >= 1.0.0-M1, <= 1.0.0-M46

Identifiers

  • CVE-2026-69218
  • GHSA-cp4q-fqw9-4hf6

Timeline

  • 2026-09-15: disclosed: Published to GitHub Advisory Database
  • 2026-09-15: patched: Patches released: v0.23.35 and v1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.