CVE-2026-88975: Http4s Ember HTTP/2 frame buffering denial of service

CVE-2026-88975 · Severity: high · CVSS 7.5 · Published 2026-09-15

Http4s Ember is a Scala HTTP server and client library. An unauthenticated attacker can cause the HTTP/2 implementation to buffer extremely large frames in memory before validating the frame size, leading to memory exhaustion and service unavailability. By exploiting the order of frame parsing operations, an attacker can consume gigabytes of heap memory with minimal network bandwidth.

Technologies: Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven), org.http4s:http4s-ember-core_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-88975 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88975 being exploited in the wild.
How severe is CVE-2026-88975?
High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?
Http4s-Ember-Core 0.23.36 and earlier (all Scala versions: 2.12, 2.13, 3); 1.0.0-M1 through 1.0.0-M47; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.37; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.37; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.37.
Is there a fix for CVE-2026-88975?
Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.37 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.37 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88975 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88975?
Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.37 or later
    # set org.http4s:http4s-ember-core_2.12 to 0.23.37 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.37 or later
    # set org.http4s:http4s-ember-core_2.13 to 0.23.37 in your pom.xml or build.gradle
  • org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.37 or later
    # set org.http4s:http4s-ember-core_3 to 0.23.37 in your pom.xml or build.gradle

Technical details

The vulnerability exists in Http4s Ember's HTTP/2 frame parsing logic. The H2Frame.RawFrame.fromByteVector function reads a frame's declared payload length from the first 9 bytes without checking it against SETTINGS_MAX_FRAME_SIZE. The readLoop then buffers the entire payload into a contiguous accumulator before the frame is passed to processFrame, which performs the actual size validation. This means oversized frames or incomplete frames with large declared lengths can consume up to 16 MiB per connection (amplified 1024x over the advertised 16 KiB limit). At the default 1024 concurrent connections, this can exhaust approximately 16 GiB of heap. An attacker can trigger this by either sending a complete oversized frame or slowly dribbling a payload while declaring a maximum size (16 MiB), keeping the connection alive indefinitely without violating idle timeouts. Patched versions validate frame size before or during buffering.

Affected products

  • Http4s http4s-ember-core 0.23.36 and earlier (all Scala versions: 2.12, 2.13, 3); 1.0.0-M1 through 1.0.0-M47

Identifiers

  • CVE-2026-88975
  • GHSA-gq9p-f254-h286

Timeline

  • 2026-09-15: disclosed: GitHub Advisory Database published
  • 2026-09-08: advisory: GitHub reviewed advisory
  • 2026-09-15: patched: Patched in version 0.23.37 and 1.0.0-M48

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.