CVE-2026-69203: Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
An ember server with HTTP/2 enabled (.withHttp2) does not enforce SETTINGS_MAX_CONCURRENT_STREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting the heap.
References
- github.com/advisories/GHSA-9vwc-pc8p-253q
- github.com/http4s/http4s/commit/4983de1f93f2caaa3b9de310cf6a9db32c50d66e
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-9vwc-pc8p-253q
- nvd.nist.gov/vuln/detail/CVE-2026-69203
Code Behaviors & Features
Detect and mitigate CVE-2026-69203 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →