Denial of Service Vulnerability in Http4s HTTP/2 Implementation
CVE-2026-54556
What is CVE-2026-54556?
The Http4s framework has a vulnerability in its HTTP/2 implementation, specifically affecting the Ember backend prior to specified versions. An unauthenticated HTTP/2 peer can exploit this flaw to induce an out-of-memory condition. When handling HEADERS and CONTINUATION frame fragments, the Hpack wrapper fails to properly account for the size of indexed headers and HPACK per-header overhead. As a result, a minimal compressed header block can inflate in size, leading to excessive memory usage. Systems exposed to untrusted HTTP/2 traffic are particularly at risk, as multiple malicious connections can overwhelm server resources and exhaust the heap memory necessary for operation. This vulnerability was addressed in versions 0.23.35 and 1.0.0-M47.
Affected Version(s)
http4s < 0.23.35 < 0.23.35
http4s >= 1.0.0-M1, < 1.0.0-M46 < 1.0.0-M1, 1.0.0-M46
http4s-ember-core_2.12 < 0.23.35