CVE-2026-69218: Denial of Service via Unbounded HTTP/2 Continuation Frame Buffering in http4s Ember
Vulnerability ID: CVE-2026-69218
CVSS Score: 7.5
Published: 2026-09-15
A critical resource exhaustion vulnerability exists in the http4s Ember HTTP/2 server and client implementations. By failing to limit the size or quantity of incoming HTTP/2 CONTINUATION frames, the engine allows unauthenticated remote attackers to exhaust JVM heap memory, causing a complete Denial of Service.
TL;DR
Unbounded HTTP/2 CONTINUATION frames cause JVM heap exhaustion and DoS in http4s Ember.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-770
- Attack Vector: Network (AV:N)
- CVSS v3.1: 7.5 (High)
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- http4s-ember-server
- http4s-ember-client
-
http4s-ember-core: < 0.23.35 (Fixed in:
0.23.35) -
http4s-ember-core: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in:
1.0.0-M47)
Code Analysis
Commit: f9dcca4
Enforce maximum header list size dynamically inside H2Connection continuation parser loop.
Commit: 6e8eccd
Enforce HPACK dynamic decoding limits, track specification-mandated overhead, and apply active timeouts.
Mitigation Strategies
- Upgrade http4s library dependencies to patched versions (0.23.35 or 1.0.0-M47)
- Deploy a reverse proxy such as Nginx or Envoy in front of http4s to handle the HTTP/2 frame layer
- Apply strict request rate-limiting and connection limits at the edge firewall
Remediation Steps:
- Identify all projects and microservices using org.http4s:http4s-ember-server or org.http4s:http4s-ember-client.
- Update build definitions (e.g., build.sbt) to use version 0.23.35 or 1.0.0-M47.
- Validate the fix by verifying that incoming headers exceeding configured limits trigger HTTP/2 EnhanceYourCalm (0xb) errors.
- Re-deploy the updated service instances and monitor JVM memory performance metrics.
References
Read the full report for CVE-2026-69218 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)