CVE-2026-54556

Deferred Deferred - Pending Action

HTTP/2 DoS in Http4s via HPACK Header Expansion

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-54556

EUVD

EUVD-2026-66558

Affected Vendors & Products

Vendor	Product	Version / Range
http4s	http4s	to 0.23.35 (inc)
http4s	http4s	to 1.0.0-M47 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

CVE-2026-54556 is a Denial of Service (DoS) vulnerability in the http4s library's Ember backend when HTTP/2 is enabled. It involves an HPACK bomb attack where specially crafted header frames exploit a flaw in HPACK header compression handling. The system concatenates header and continuation frames before decoding all at once, causing significant memory amplification. This leads to OutOfMemoryError due to excessive heap usage, particularly with around five concurrent connections on a 2GB heap.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory usage or crashes in http4s applications using Ember HTTP/2. Check for OutOfMemoryError logs in your application server. Monitor network traffic for malformed HTTP/2 header frames or excessive concurrent connections. Use tools like Wireshark to inspect HTTP/2 frames for unusually large header blocks or continuation frames.

Impact Analysis

This vulnerability can cause your http4s server or client to crash due to memory exhaustion, leading to complete system unavailability. Servers exposed to untrusted HTTP/2 traffic or clients directed to untrusted servers are affected. Concurrent malicious connections can exhaust the process heap, making the system unresponsive.

Compliance Impact

This vulnerability primarily causes denial of service by exhausting system resources, which could lead to service unavailability. While not directly violating GDPR or HIPAA, such disruptions may impact data processing operations subject to these regulations, potentially causing delays in access to personal or health data. However, the provided context does not specify direct compliance implications.

Mitigation Strategies

Upgrade http4s to version 0.23.35 or 1.0.0-M47 or later to apply the security fixes.
Disable HTTP/2 if not required, as the vulnerability is tied to HTTP/2 functionality.
Implement network-level protections such as rate limiting or WAF rules to block malicious HTTP/2 traffic.
Monitor system memory usage and set up alerts for abnormal spikes that may indicate an ongoing attack.

Hi! I’m here to help you understand CVE-2026-54556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70