DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69213: CVE-2026-69213: Uncontrolled Resource Consumption (DoS) in http4s Ember HTTP/2 Implementation

#security #cve #cybersecurity

CVE-2026-69213: Uncontrolled Resource Consumption (DoS) in http4s Ember HTTP/2 Implementation

Vulnerability ID: CVE-2026-69213
CVSS Score: 7.5
Published: 2026-09-15

An uncontrolled resource consumption vulnerability (CVE-2026-69213) in the http4s Ember HTTP/2 server and client implementations allows unauthenticated remote attackers to trigger an OutOfMemoryError (OOM) and cause a Denial of Service (DoS) by exploiting unbounded outbound queues.

TL;DR

Ember HTTP/2 in http4s fails to limit outbound response queues, permitting remote attackers to crash the JVM via OutOfMemoryError by flooding control frames while stalling socket reads.

Technical Details

  • CWE ID: CWE-400, CWE-770
  • Attack Vector: Network
  • CVSS v3.1: 7.5 (High)
  • Impact: Denial of Service (DoS)
  • Exploit Status: No Public Exploit Available
  • KEV Status: Not Listed

Affected Systems

  • org.http4s:http4s-ember-core
  • http4s Ember HTTP/2 Server
  • http4s Ember HTTP/2 Client
  • http4s-ember-core: < 0.23.35 (Fixed in: 0.23.35)
  • http4s-ember-core: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: 13fe24d

Replace Queue.unbounded with Queue.bounded(128) in H2Client and H2Server to prevent memory exhaustion

Mitigation Strategies

  • Upgrade to http4s v0.23.35, v1.0.0-M47, or newer versions
  • Disable HTTP/2 support in Ember server configuration if not strictly necessary
  • Utilize a reverse proxy or load balancer to handle HTTP/2 connection management and write timeouts

Remediation Steps:

  1. Locate configuration files defining the http4s Ember server or client setup.
  2. Update your project build configuration (e.g., build.sbt) to reference version 0.23.35 or 1.0.0-M47 of 'http4s-ember-core' and related modules.
  3. If updating is not possible, disable HTTP/2 by removing calls to 'withHttp2' from the server builder.
  4. Deploy or configure an upstream proxy (like Nginx or AWS ALB) to enforce aggressive read and write timeout policies on HTTP/2 sessions.

References

Read the full report for CVE-2026-69213 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)