CVE-2026-69218

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-69215

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

CVE-2026-69206

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-69203

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...

CVE-2026-69202

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

CVE-2026-88975

Http4s (a Scala HTTP library) is vulnerable in Ember's HTTP/2 read loop prior to versions 0.23.37 and 1.0.0-M48 . The loop parses a frame's 24-bit declared length but buffers the entire payload before comparing it against SETTINGS_MAX_FRAME_SIZE . An unauthenticated peer can declare a payload nea...

EUVD-2026-79239

Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGSMAXFRAMESIZE. An unauthenticated peer can declare a payload near 16 MiB on a...

CVE-2026-88975 Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGSMAXFRAMESIZE. An unauthenticated peer can declare a payload near 16 MiB on a...

CVE-2026-69206

Http4s (a Scala HTTP service framework) has a DigestAuth replay vulnerability prior to versions 0.23.35 and 1.0.0-M47 . The replay protection records lastNc + 1 instead of the highest accepted nonce-count value. When a legitimate client sends noncontiguous nc values (due to parallel or retried re...

EUVD-2026-79236

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-69202 Http4s Ember HTTP/2: unbounded inbound body buffering

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

CVE-2026-69202 Http4s Ember HTTP/2: unbounded inbound body buffering

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

EUVD-2026-79234

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can...

CVE-2026-69202

Http4s is a Scala HTTP services library. In versions prior to 0.23.35 and 1.0.0-M47 , Ember's HTTP/2 flow-control window is replenished based on bytes received from the network rather than bytes consumed by the application, and each stream stores DATA in an unbounded channel . A remote peer can t...

CVE-2026-69218

Http4s Ember HTTP/2 is vulnerable to unbounded continuation frame accumulation in its H2Connection component. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, it buffers the header block and subsequent CONTINUATION fragments without a size bound . A remote peer can...

CVE-2026-69218 Http4s Ember HTTP/2: unbounded continuation frame accumulation

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

EUVD-2026-79195

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

EUVD-2026-79194

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...

CVE-2026-69203 Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...