CVE-2026-69218: HTTP4S

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Affected products

• HTTP4S HTTP4S: before 0.23.35 (fixed in 0.23.35); from 1.0.0-M1, before 1.0.0-M47 (fixed in 1.0.0-M47)

Published 2026-09-15. Last modified 2026-09-17.