CVE-2026-69203

http4s Ember, when HTTP/2 is explicitly enabled via .withHttp2, fails to enforce the SETTINGS_MAX_CONCURRENT_STREAMS limit, allowing a single unauthenticated connection to open an unbounded number of concurrent streams whose per-stream state is never released. An attacker can exploit this to exhaust the JVM heap and crash or degrade any Ember server speaking HTTP/2, making it a resource-exhaustion flaw in the same family as the 2023 HTTP/2 Rapid Reset attacks (CVE-2023-44487). The same unchecked allocation is reachable in ember-client through server-initiated PUSH_PROMISE frames, so a malicious or compromised origin can exhaust clients that make HTTP/2 requests to it. Affected parties are Scala/JVM services built on http4s Ember with HTTP/2 enabled, and ember clients connecting over HTTP/2 to untrusted servers. No public proof of concept is known and the flaw is not in the CISA KEV catalog, so exploitation in the wild is not indicated.

What to do: Upgrade Ember server and client to the next patched http4s release as soon as Typelevel publishes one, since no fixed version is identified in the advisory. Until then, disable HTTP/2 on EmberServerBuilder and EmberClientBuilder (this is the default configuration), and for clients avoid HTTP/2 to untrusted origins. If HTTP/2 must be kept, place Ember behind a load balancer or proxy that strictly enforces SETTINGS_MAX_CONCURRENT_STREAMS and monitor JVM heap and connection/stream counts for anomalous growth.