Http4s: HTTP/2 Denial of Service with Ember Backend
Summary
| CVE | CVE-2026-54556 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-26 15:16:49 UTC |
| Updated | 2026-08-29 03:17:07 UTC |
| Description | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47. |
Risk And Classification
Primary CVSS: v4.0 8.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-409 | CWE-409 CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 8.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
NoneIntegrity
NoneAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Http4s | Http4s | affected < 0.23.35 | Not specified |
| CNA | Http4s | Http4s | affected >= 1.0.0-M1, < 1.0.0-M46 | Not specified |
| CNA | Org.http4s | Http4s-ember-core 2.12 | affected < 0.23.35 | Not specified |
| CNA | Org.http4s | Http4s-ember-core 2.13 | affected >= 1.0.0-M1, < 1.0.0-M46 | Not specified |
| CNA | Org.http4s | Http4s-ember-core 2.13 | affected < 0.23.35 | Not specified |
| CNA | Org.http4s | Http4s-ember-core 3 | affected >= 1.0.0-M1, < 1.0.0-M46 | Not specified |
| CNA | Org.http4s | Http4s-ember-core 3 | affected < 0.23.35 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e | [email protected] | github.com | |
| github.com/http4s/http4s/releases/tag/v1.0.0-M47 | [email protected] | github.com | |
| github.com/http4s/http4s/security/advisories/GHSA-vmm3-xgcx-67hm | [email protected] | github.com | |
| github.com/http4s/http4s/releases/tag/v0.23.35 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.