CVE-2026-69218

Katalog CVE

CVSS 7.5 · High EPSS 0,63%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete block open and exhaust heap memory before request decoding, affecting an ember-server or ember-client configured with withHttp2. The remediation tracks accumulated size against SETTINGS_MAX_HEADER_LIST_SIZE derived from EmberServerBuilder.maxHeaderSize or EmberClientBuilder.maxResponseHeaderSize, sends GOAWAY when the limit is exceeded, and applies receiveHeadersTimeout to incomplete blocks. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

17 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/http4s/http4s/commit/6e8eccd64a6a74ab4811897881e95e0e1b3a818e
• https://github.com/http4s/http4s/commit/f9dcca4f5a17992ac0972fafd7920f9bc12cdc51
• https://github.com/http4s/http4s/releases/tag/v0.23.35
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
• https://github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6