CVE-2026-69213: Http4s Ember HTTP/2: unbounded outbound frame queue
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause Ember to enqueue acknowledgments or WINDOWUPDATE frames faster than the writer drains them, exhausting heap memory on a server built with withHttp2. The shared behavior also affects an ember-client connected to a hostile HTTP/2 server, and the patch replaces the unbounded path with bounded, backpressured outbound queues. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s-ember-http2to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s-ember-http2to a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are exposed?
Servers built with withHttp2 are exposed when using affected Ember HTTP/2 versions. Ember clients are also affected if they connect to a hostile HTTP/2 server.
What does an attacker need to do to exploit this?
No authentication or user interaction is required. A peer that stops reading can send HTTP/2 PING, SETTINGS, or DATA frames, causing acknowledgment or WINDOW_UPDATE frames to accumulate faster than Ember can write them.
What is the impact of successful exploitation?
The unbounded outbound frame queue can exhaust heap memory, resulting in a denial of service.
What versions contain the fix?
The issue is fixed in Http4s versions 0.23.35 and 1.0.0-M47, which use bounded, backpressured outbound queues.