A AegiFlow
HIGHCVSS 7.5EPSS 0.6%

CVE-2026-88975

CVE-2026-88975 updated by NVD

Published
2026-09-15
Modified
2026-09-18
EPSS percentile
48%
Sources
github-advisory, nvd

Summary

Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.

Affected packages

EcosystemPackageAffected versionsFixed versions
Mavenorg.http4s:http4s-ember-core_2.120.23.37
Mavenorg.http4s:http4s-ember-core_2.130.23.37, 1.0.0-M48
Mavenorg.http4s:http4s-ember-core_30.23.37, 1.0.0-M48

Remediation: Upgrade to 0.23.37 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.