CVE-2026-69213

http4s Ember, the Scala HTTP server and client implementation, serializes outbound HTTP/2 frames through a single unbounded queue consumed by its writeLoop. An unauthenticated remote attacker can trigger the flaw by sending a stream of PING, SETTINGS, or DATA frames while refusing to read responses, causing Ember to enqueue acknowledgments and WINDOW_UPDATE frames faster than the writer drains them, which exhausts heap memory and crashes or degrades the service. This only affects servers explicitly built with withHttp2, but the same shared behavior also exposes an ember-client that connects to a malicious HTTP/2 server. The vulnerability is rated high (CVSS 3.1: 7.5) with availability-only impact and requires no privileges or user interaction. There is no known public proof of concept and no evidence of exploitation in the wild, and the issue is fixed in versions 0.23.35 and 1.0.0-M47.

What to do: Upgrade to http4s 0.23.35 (stable line) or 1.0.0-M47 (milestone line), where outbound queues are bounded and backpressured. If immediate upgrade is not possible, remove withHttp2 from Ember servers or front them with a reverse proxy that enforces HTTP/2 frame limits, and restrict ember-client usage to trusted upstream servers. Monitor JVM heap usage and connection behavior for unexpected growth from slow-reading peers.