CVE-2026-69210: Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s WebSocket FrameTranscoder/decoderto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s WebSocket FrameTranscoder/decoderto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using an Ember server with affected Http4s versions are exposed when they accept WebSocket connections. A remote client can trigger the issue after completing a WebSocket handshake.
Does exploiting this issue require authentication or user interaction?
No. The supplied severity vector indicates network access with low attack complexity, no privileges required, and no user interaction.
What is the impact of a successful attack?
The WebSocket decoder can enter an infinite loop that pins a worker at full CPU and grows an ArrayBuffer without bound, causing denial of service.
Which versions contain the fix?
The issue is fixed in Http4s versions 0.23.35 and 1.0.0-M47.