CVE-2026-69202: Http4s Ember HTTP/2: unbounded inbound body buffering
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in heap on an ember-server or ember-client configured with withHttp2. The patch bounds the per-stream H2Connection body channel so application consumption applies backpressure. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s/ember-http2to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s/ember-http2to a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are exposed?
Ember servers and Ember clients configured with withHttp2 are affected if they use a version prior to 0.23.35 or 1.0.0-M47. HTTP/2 must be in use for the vulnerable flow-control and buffering behavior to apply.
What does an attacker need to do to trigger the issue?
A hostile HTTP/2 peer can send request or response body DATA faster than the receiving application consumes it. No authentication or user interaction is required according to the supplied severity vector.
What is the practical impact?
Payload data can accumulate in an unbounded per-stream channel and remain in heap memory when the application is slow to consume, or does not consume, the body. This can cause denial of service through memory exhaustion.
How can the issue be remediated?
Upgrade to http4s version 0.23.35 or 1.0.0-M47. The fix bounds the per-stream HTTP/2 body channel so that application consumption applies backpressure.