DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54556: CVE-2026-54556: Heap Exhaustion and Denial of Service in http4s Ember HTTP/2 Backend via HPACK Bomb

#security #cve #cybersecurity

CVE-2026-54556: Heap Exhaustion and Denial of Service in http4s Ember HTTP/2 Backend via HPACK Bomb

Vulnerability ID: CVE-2026-54556
CVSS Score: 8.2
Published: 2026-08-26

CVE-2026-54556 is a high-severity Denial of Service (DoS) vulnerability impacting the Ember HTTP/2 backend of http4s, a popular functional Scala interface for HTTP services. The vulnerability arises from an improper handling of highly compressed HPACK header blocks, which enables unauthenticated remote attackers to trigger severe memory amplification and crash the JVM runtime via an OutOfMemoryError.

TL;DR

The http4s Ember HTTP/2 backend is vulnerable to HPACK bomb attacks (CWE-409), allowing remote, unauthenticated attackers to trigger heap exhaustion and crash the server via highly compressed header payloads. This is addressed in versions 0.23.35 and 1.0.0-M47.

Technical Details

  • CWE ID: CWE-409 (Data Amplification)
  • Attack Vector: Network (Remote, Unauthenticated)
  • CVSS Score: 8.2 (High)
  • Exploit Status: None (No public PoC or active exploitation)
  • CISA KEV Status: Not Listed
  • Primary Impact: Denial of Service (JVM Heap Exhaustion via OOM)
  • Affected Components: Ember HTTP/2 backend in http4s-ember-core

Affected Systems

  • http4s-ember-core_2.12
  • http4s-ember-core_2.13
  • http4s-ember-core_3
  • http4s-ember-core: < 0.23.35 (Fixed in: 0.23.35)
  • http4s-ember-core: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: 6e8eccd

Fix HPACK Bomb vulnerability in Ember HTTP/2 backend by introducing active size tracking and continuation frame timeouts.

Mitigation Strategies

  • Upgrade http4s-ember-core to patched versions (0.23.35 or 1.0.0-M47).
  • Deploy a reverse proxy (e.g., Nginx, HAProxy) to enforce strict limits on HTTP/2 header size and timeout slow connections.
  • Disable HTTP/2 on the Ember backend to completely eliminate the HPACK attack surface.
  • Configure JVM flags (-XX:+CrashOnOutOfMemoryError) to force rapid self-healing container restarts upon heap exhaustion.

Remediation Steps:

  1. Identify all projects importing http4s-ember-core in build.sbt or Maven configuration files.
  2. Update the dependency version: libraryDependencies += "org.http4s" %% "http4s-ember-core" % "0.23.35" (or "1.0.0-M47").
  3. Clean build cache and recompile the project to verify transitive dependency resolution.
  4. If direct patching is blocked, configure an upstream proxy or WAF with HTTP/2 header constraints.
  5. Verify the deployment's recovery behavior by configuring clean JVM termination on OOM.

References

Read the full report for CVE-2026-54556 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)