CVE-2026-83276

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-83280

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-69203

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...

CVE-2026-69202

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

EUVD-2026-79632

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-83280

CVE-2026-83280 is a Denial of Service vulnerability in Oracle Helidon (component: helidon-webserver-http2 ), part of Oracle Fusion Middleware. Affected versions are 4.0.0 through 4.5.4 . An unauthenticated attacker with network access can send crafted requests via HTTP/2 to cause a hang or freque...

CVE-2026-83276

CVE-2026-83276 affects the helidon-webclient-http2 component of Oracle Helidon (part of Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP/2 can trigger a hang or frequently repeatable crash, resulting in a complete denial of service...

EUVD-2026-79628

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a connection where Ember advertised a 16 KiB limit. The declared length is readable from the frame's first 9 bytes, but it is not compared against SETTINGSMAXFRAMESIZE until the whole...

GHSA-GQ9P-F254-H286 Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a connection where Ember advertised a 16 KiB limit. The declared length is readable from the frame's first 9 bytes, but it is not compared against SETTINGSMAXFRAMESIZE until the whole...

GHSA-CP4Q-FQW9-4HF6 Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

GHSA-8F3Q-3JMV-7PRW Http4s Ember HTTP/2 has an unbounded outbound frame queue

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber writeLoop. When the write side stalls, any frames the connection keeps producing accumulate in that queue without limit. The peer can drive this cheaply because the connection emi...

Http4s Ember HTTP/2 has an unbounded outbound frame queue

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber writeLoop. When the write side stalls, any frames the connection keeps producing accumulate in that queue without limit. The peer can drive this cheaply because the connection emi...

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

GHSA-9VWC-PC8P-253Q Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

Http4s Ember HTTP/2: unbounded inbound body buffering

Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body...

GHSA-6M4X-PP6Q-5JMM Http4s Ember HTTP/2: unbounded inbound body buffering

Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body...

CVE-2026-88975

Http4s (a Scala HTTP library) is vulnerable in Ember's HTTP/2 read loop prior to versions 0.23.37 and 1.0.0-M48 . The loop parses a frame's 24-bit declared length but buffers the entire payload before comparing it against SETTINGS_MAX_FRAME_SIZE . An unauthenticated peer can declare a payload nea...