Every CVE Search/ Get API key

CVE-2026-69203

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

7.5 HighFix available

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.63%Up 0.2 points since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Record
CVE-2026-69203
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-79194 7.5

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Record
EUVD-2026-79194
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9vwc-pc8p-253q 7.5

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.

Impact

Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).

The same unchecked allocation path is reachable on the client via server-initiated PUSH_PROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.

Preconditions

  • Server: with .withHttp2 enabled.
  • Client: makes HTTP/2 requests to malicious or compromised sites. enablePush is not enforced.

Workarounds

  • Disable HTTP/2 on EmberServerBuilder or EmberClientBuilder (default)
  • Client only: avoid HTTP/2 to untrusted servers until patched.
Record
GHSA-9vwc-pc8p-253q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 7.5

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Record
CVE-2026-69203
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.5

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Record
CVE-2026-69203
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVGHSA-9vwc-pc8p-253q 7.5

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.

Impact

Unauthenticated remote denial of service (memory exhaustion) against any Ember server built .withHttp2. This is the resource-exhaustion class of the HTTP/2 "Rapid Reset" family (CVE-2023-44487).

The same unchecked allocation path is reachable on the client via server-initiated PUSH_PROMISE frames, so a malicious or compromised server can exhaust an ember-client's heap the same way.

Preconditions

  • Server: with .withHttp2 enabled.
  • Client: makes HTTP/2 requests to malicious or compromised sites. enablePush is not enforced.

Workarounds

  • Disable HTTP/2 on EmberServerBuilder or EmberClientBuilder (default)
  • Client only: avoid HTTP/2 to untrusted servers until patched.
Record
GHSA-9vwc-pc8p-253q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.http4s:http4s-ember-core_2.12
Maven
 through 0.23.34
0.23.35
org.http4s:http4s-ember-core_2.13
Maven
 through 0.23.34
0.23.35
org.http4s:http4s-ember-core_3
Maven
 through 0.23.34
0.23.35
org.http4s:http4s-ember-core_2.13
Maven
 1.0.0-M1 to 1.0.0-M46
1.0.0-M47
org.http4s:http4s-ember-core_3
Maven
 1.0.0-M1 to 1.0.0-M46
1.0.0-M47
org.http4s:http4s-ember-core_2.12
Maven
 before 0.23.35, plus listed versions
0.10.0-M100.21.00.21.0-M20.21.0-M30.21.0-M4
Show 45 moreShow less
0.21.0-M50.21.0-M60.21.0-RC10.21.0-RC20.21.0-RC30.21.0-RC40.21.0-RC50.21.10.21.110.21.120.21.130.21.140.21.150.21.160.21.170.21.180.21.190.21.20.21.200.21.210.21.220.21.230.21.240.21.250.21.260.21.270.21.280.21.290.21.30.21.300.21.310.21.320.21.330.21.340.21.40.21.50.21.60.21.70.21.80.21.90.22-129-24d065b0.22-143-49b5a8d0.22-53-01128f50.22-96-55d31840.22.0
0.23.35
org.http4s:http4s-ember-core_2.13
Maven
 before 0.23.35, plus listed versions
0.10.0-M100.21.00.21.0-M20.21.0-M30.21.0-M4
Show 45 moreShow less
0.21.0-M50.21.0-M60.21.0-RC10.21.0-RC20.21.0-RC30.21.0-RC40.21.0-RC50.21.10.21.110.21.120.21.130.21.140.21.150.21.160.21.170.21.180.21.190.21.20.21.200.21.210.21.220.21.230.21.240.21.250.21.260.21.270.21.280.21.290.21.30.21.300.21.310.21.320.21.330.21.340.21.40.21.50.21.60.21.70.21.80.21.90.22-129-24d065b0.22-143-49b5a8d0.22-53-01128f50.22-96-55d31840.22.0
0.23.35
org.http4s:http4s-ember-core_3
Maven
 before 0.23.35, plus listed versions
0.22.00.22.0-M80.22.0-RC10.22.10.22.10
Show 45 moreShow less
0.22.110.22.120.22.130.22.140.22.150.22.20.22.30.22.40.22.50.22.60.22.70.22.80.22.90.23.00.23.0-M10.23.0-RC10.23.10.23.100.23.110.23.120.23.130.23.140.23.150.23.160.23.170.23.180.23.190.23.19-RC10.23.19-RC20.23.19-RC30.23.20.23.200.23.210.23.220.23.230.23.240.23.250.23.260.23.270.23.280.23.290.23.30.23.300.23.310.23.32
0.23.35
org.http4s:http4s-ember-core_2.13
Maven
 1.0.0-M1 up to 1.0.0-M47, plus listed versions
1.0.0-M101.0.0-M111.0.0-M131.0.0-M141.0.0-M15
Show 38 moreShow less
1.0.0-M161.0.0-M171.0.0-M181.0.0-M191.0.0-M21.0.0-M201.0.0-M211.0.0-M221.0.0-M231.0.0-M241.0.0-M251.0.0-M271.0.0-M281.0.0-M291.0.0-M31.0.0-M301.0.0-M311.0.0-M321.0.0-M331.0.0-M341.0.0-M351.0.0-M361.0.0-M371.0.0-M381.0.0-M391.0.0-M41.0.0-M401.0.0-M411.0.0-M421.0.0-M431.0.0-M441.0.0-M451.0.0-M461.0.0-M51.0.0-M61.0.0-M71.0.0-M81.0.0-M9
1.0.0-M47
org.http4s:http4s-ember-core_3
Maven
 1.0.0-M1 up to 1.0.0-M47, plus listed versions
1.0.0-M221.0.0-M231.0.0-M241.0.0-M251.0.0-M27
Show 19 moreShow less
1.0.0-M281.0.0-M291.0.0-M301.0.0-M311.0.0-M321.0.0-M331.0.0-M341.0.0-M351.0.0-M361.0.0-M371.0.0-M381.0.0-M391.0.0-M401.0.0-M411.0.0-M421.0.0-M431.0.0-M441.0.0-M451.0.0-M46
1.0.0-M47

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-69203 is a high vulnerability (CVSS 7.5) in Http4s, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in org.http4s:http4s-ember-core_2.12 0.23.35.

References

This page doesn't list everything

Left out here: 136 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open