CVE-2026-69203: Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSHPROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s-emberto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s-emberto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are exposed?
Ember servers are exposed when HTTP/2 has been enabled with withHttp2 in versions before 0.23.35 or 1.0.0-M47. Ember clients in those versions can also be affected by server-initiated PUSH_PROMISE frames.
What does an attacker need to exploit this?
Against an affected HTTP/2-enabled Ember server, an attacker needs only one unauthenticated connection and can create an unbounded number of streams. Against an affected Ember client, a server can trigger the unchecked allocation using PUSH_PROMISE frames.
What is the impact of successful exploitation?
Each created stream retains per-stream state, allowing memory consumption to grow until heap exhaustion. This results in a denial of service; the provided vector indicates no confidentiality or integrity impact.
What should be done if patching cannot happen immediately?
Disable HTTP/2 on Ember servers by avoiding withHttp2 until an upgrade is possible. For Ember clients, avoid connections to servers that can send PUSH_PROMISE frames until the fixed version is deployed.
Which versions contain the fix?
The issue is fixed in versions 0.23.35 and 1.0.0-M47.