HTTP/2 Flow-Control Vulnerability in Http4s
CVE-2026-69202
7.5HIGH
What is CVE-2026-69202?
Ember's HTTP/2 flow-control window in Http4s fails to limit the input stream rate, which can lead to unbounded data accumulation in memory. A malicious actor can exploit this by sending data packets at a faster rate than the application can process, resulting in potential denial-of-service conditions due to excessive memory usage. The vulnerability was addressed in versions 0.23.35 and 1.0.0-M47, where the per-stream H2Connection body channel was restricted to prevent such backpressure issues.
Affected Version(s)
http4s < 0.23.35 < 0.23.35
http4s >= 1.0.0-M1, < 1.0.0-M47 < 1.0.0-M1, 1.0.0-M47