CVE-2026-69218: Http4s Ember HTTP/2: unbounded continuation frame accumulation
When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without the END_HEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes.
References
- github.com/advisories/GHSA-cp4q-fqw9-4hf6
- github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6
- nvd.nist.gov/vuln/detail/CVE-2026-69218
Code Behaviors & Features
Detect and mitigate CVE-2026-69218 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →