fkie_cve-2026-69203

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

GHSA-9vwc-pc8p-253q — Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

Affected: Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3

An ember server with HTTP/2 enabled (`.withHttp2`) does not enforce `SETTINGS_MAX_CONCURRENT_STREAMS` on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.

## Impact

Unauthenticated remote denial of service (memory exhaustion) against any Ember server built `.withHttp2`. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).

The same unchecked allocation path is reachable on the client via server-initiated `PUSH_PROMISE` frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.

## Preconditions

- Server: with `.withHttp2` enabled. - Client: makes HTTP/2 requests to malicious or compromised sites. `enablePush` is not enforced.

## Workarounds

- Disable HTTP/2 on `EmberServerBuilder` or `EmberClientBuilder` (default) - Client only: avoid HTTP/2 to untrusted servers until patched.

Most recent entries from all

fkie_cve-2026-69203

GHSA-9vwc-pc8p-253q — Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS