CVE-2026-88975: CVE-2026-88975: Heap Memory Exhaustion via Malicious HTTP/2 Frame Size in http4s Ember

#security #cve #cybersecurity

CVE-2026-88975: Heap Memory Exhaustion via Malicious HTTP/2 Frame Size in http4s Ember

Vulnerability ID: CVE-2026-88975
CVSS Score: 7.5
Published: 2026-09-15

An uncontrolled resource consumption vulnerability in the http4s Ember HTTP/2 server and client implementation leads to unauthenticated heap memory exhaustion and denial of service. The vulnerability stems from deferring frame size validation until the entire declared payload size is buffered.

TL;DR

Unauthenticated remote peers can trigger heap memory exhaustion and Denial of Service in http4s Ember HTTP/2 implementations by sending frames with large declared size headers.

Technical Details

CWE ID: CWE-400
Attack Vector: Network
CVSS Severity: 7.5 (High)
Exploit Status: None
Impact: Denial of Service

Affected Systems

http4s-ember-server
http4s-ember-client
http4s-ember-server: < 0.23.37 (Fixed in: 0.23.37)
http4s-ember-client: < 0.23.37 (Fixed in: 0.23.37)
http4s-ember-server: >= 1.0.0-M1 < 1.0.0-M48 (Fixed in: 1.0.0-M48)
http4s-ember-client: >= 1.0.0-M1 < 1.0.0-M48 (Fixed in: 1.0.0-M48)

Code Analysis

Commit: 87cf334

Reject oversized h2 frames before reading payload

Mitigation Strategies

Upgrade http4s-ember dependencies to version 0.23.37 or 1.0.0-M48
Disable HTTP/2 on Ember servers if upgrading is not immediately possible

Remediation Steps:

Open the project build configuration (e.g., build.sbt).
Locate the dependencies for http4s-ember-server and http4s-ember-client.
Update the version identifier to 0.23.37 or 1.0.0-M48.
Reload the build configuration and recompile the project.
Verify that HTTP/2 connections are correctly rejected when sending frames exceeding maxFrameSize.

References

Read the full report for CVE-2026-88975 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community