CVE-2026-88975

Received Received - Intake

Memory Amplification in Http4s via HTTP/2 Frame Length

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-88975

EUVD

EUVD-2026-79239

Affected Vendors & Products

Vendor	Product	Version / Range
http4s	http4s	to 0.23.37 (exc)
http4s	http4s	to 1.0.0-M48 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Http4s allows an unauthenticated attacker to send an HTTP/2 frame with a declared payload size much larger than the allowed limit. The system buffers the entire frame before validating its size, causing up to 16 GiB of memory usage per connection. This leads to memory exhaustion and potential denial-of-service attacks.

Detection Guidance

Detecting this vulnerability requires checking if your http4s version is vulnerable. Use commands like 'curl -s https://your-server.com | grep Server' or inspect server headers. For Scala projects, check build.sbt or dependency files for http4s versions below 0.23.37 or 1.0.0-M48.

Impact Analysis

This vulnerability can cause denial-of-service conditions by consuming excessive memory on affected systems. It may lead to system slowdowns, crashes, or permanent connection hangs, impacting availability of services using Http4s with HTTP/2 enabled.

Compliance Impact

This vulnerability primarily enables denial-of-service (DoS) attacks through memory amplification, which could lead to service disruptions. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems handling personal or health data, potentially violating compliance requirements for data accessibility and security.

Mitigation Strategies

Upgrade http4s to version 0.23.37 or 1.0.0-M48 or later. If upgrading is not possible, disable HTTP/2 support in your configuration. Monitor network traffic for unusually large HTTP/2 frames as a potential attack vector.

Hi! I’m here to help you understand CVE-2026-88975. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70