CVE-2026-69210

http4s, a functional HTTP toolkit for Scala, contains a denial-of-service flaw in its WebSocket FrameTranscoder.bodyLength logic in versions prior to 0.23.35 and 1.0.0-M47. The decoder rejects extended payload lengths above Integer.MAX_VALUE but fails to validate negative 64-bit lengths, so a remote client that completes a WebSocket handshake against an http4s Ember server can send such a frame, causing the decoder to return an empty frame without consuming input. The decode loop then spins indefinitely, pinning a worker at full CPU and growing an ArrayBuffer without bound until the process is exhausted. Any service built on an affected http4s version that exposes Ember WebSocket endpoints to untrusted clients is vulnerable; no authentication or user interaction is required. The issue is fixed in 0.23.35 and 1.0.0-M47, and no public proof of concept or exploitation in the wild is known.

What to do: Upgrade to http4s 0.23.35 on the 0.23.x line or 1.0.0-M47 on the 1.0 milestone line. If upgrading is not immediately feasible, disable WebSocket endpoints on Ember servers or block WebSocket upgrade requests at the reverse proxy or load balancer. Monitor for workers pinned at 100% CPU or unbounded heap growth immediately following WebSocket handshakes from untrusted clients.