HTTP/2 Memory Amplification Vulnerability in Http4s by Ember
CVE-2026-88975
7.5HIGH
What is CVE-2026-88975?
A memory amplification vulnerability exists in the Ember HTTP/2 read loop in Http4s, affecting versions before 0.23.37 and 1.0.0-M48. An unauthenticated attacker can exploit this flaw by declaring a large payload that exceeds the advertised frame size, potentially causing significant memory consumption per connection. The vulnerability impacts both HTTP/2-enabled servers and clients, allowing an attacker to stream oversized data, leading to denial of service. Fortunately, the issue has been addressed in the latest updates, which enforce payload size restrictions prior to buffering.
Affected Version(s)
http4s < 0.23.37 < 0.23.37
http4s >= 1.0.0-M1, < 1.0.0-M48 < 1.0.0-M1, 1.0.0-M48