CVE-2026-54556

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47

Description An unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend when HTTP/2 is enabled. The issue resides in the Hpack wrapper within ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala, where HEADERS and CONTINUATION frame fragments are concatenated and decoded into a single List. Because the maxHeaderSize accounting fails to include indexed headers or HPACK per-header overhead, a small compressed header block can expand into a significantly larger decoded representation in memory. This can lead to process heap exhaustion when multiple malicious connections are established concurrently. This affects servers exposed to untrusted HTTP/2 traffic and clients connected to untrusted HTTP/2 servers.

Recommendations Update to version 0.23.35 or later. Update to version 1.0.0-M47 or later. As a temporary workaround, disable HTTP/2 in Ember backends.