CVE-2026-69218: Http4s Ember HTTP/2: unbounded continuation frame accumulation
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGSMAXHEADERLISTSIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s ember HTTP/2to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s ember HTTP/2to a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are ember-server or ember-client instances configured with withHttp2. The issue occurs before request decoding when a remote HTTP/2 peer sends an incomplete HEADERS or PUSH_PROMISE header block.
What does an attacker need to do to exploit this?
An unauthenticated remote peer needs to send a HEADERS or PUSH_PROMISE frame without END_HEADERS and continue sending CONTINUATION fragments. The accumulated header block is not size-bounded in affected versions, allowing heap memory exhaustion.
Are there configuration-based mitigations if upgrading is delayed?
The provided remediation bounds accumulated header data using SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, and applies receiveHeadersTimeout to incomplete blocks. Upgrade to 0.23.35 or 1.0.0-M47 to obtain these protections.
How is the connection handled after the remediation limit is exceeded?
The remediated implementation sends GOAWAY when the accumulated incomplete header block exceeds the configured limit.