fkie_cve-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

GHSA-cp4q-fqw9-4hf6 — Http4s Ember HTTP/2: unbounded continuation frame accumulation

Affected: Maven: org.http4s:http4s-ember-core_2.12, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_3

When Ember receives an HTTP/2 `HEADERS` or `PUSH_PROMISE` frame without the `END_HEADERS` flag, it buffers the header block fragment and waits for subsequent `CONTINUATION` frames. These accumulate unbounded until the connection closes.

### Impact

A remote, unauthenticated peer can exhaust the heap on any Ember endpoint that has HTTP/2 enabled:

- **ember-server with `.withHttp2`**: any HTTP/2 client can trigger this against any reachable path (including paths that return 404). No authentication is required because the attack completes before the request is decoded. - **ember-client with `.withHttp2`**: a malicious or compromised origin server can trigger this via the response header block. A single in-flight request is sufficient.

Memory consumption is bounded only by the attacker's upload bandwidth and the connection lifetime.

### Prerequisites

- `EmberServerBuilder` configured with `.withHttp2`. - For the server: the attacker can establish an HTTP/2 connection - For the client: the application makes a request to an attacker-controlled origin. HTTP/2 incoming headers exceeding the configured size limit are buffer in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

### Patches

The fix bounds the accumulated header-block size at `SETTINGS_MAX_HEADER_LIST_SIZE` (derived from `EmberServerBuilder.maxHeaderSize` / `EmberClientBuilder.maxResponseHeaderSize`). When a `CONTINUATION`…

Most recent entries from all

fkie_cve-2026-69218

GHSA-cp4q-fqw9-4hf6 — Http4s Ember HTTP/2: unbounded continuation frame accumulation