CVE-2026-69202: Http4s Ember HTTP/2: unbounded inbound body buffering

Ember’s HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body faster than the application drains it and the connection retains every payload in heap.

This is the read-path mirror of the outbound queue issue.

This affects an Ember receiving a request body and an Ember client receiving a response body from a hostile server.