Http4s: Batch of 18 CVEs Disclosed, Featuring Critical HTTP/1.1 and HTTP/2 Flaws

Key findings

• 18 vulnerabilities disclosed for Http4s, impacting Ember server and client middleware.
• Critical flaw CVE-2026-69204 involves HTTP/1.1 parser accepting conflicting Content-Length and Transfer-Encoding headers.
• Multiple High severity HTTP/2 flaws relate to unbounded stream, frame, and message buffering.
• Client middleware vulnerabilities include improper cookie domain matching and credential leakage on redirects.
• All issues patched in Http4s versions 0.23.37 and 1.0.0-M48.

On September 15, 2026, a significant batch of 18 vulnerabilities was disclosed for the Http4s Scala HTTP services interface, impacting its Ember server and client middleware components. These vulnerabilities, disclosed within a single hour, range in severity from Medium to Critical, with several High-severity flaws related to HTTP/1.1 and HTTP/2 parsing and resource handling. The disclosures highlight potential weaknesses in how Http4s manages HTTP frames, headers, cookies, and authentication, with many issues stemming from improper size bound checks and parsing logic.

Several vulnerabilities center on the handling of HTTP/2 frames and streams. CVE-2026-88975 and CVE-2026-69209 describe issues where the Ember server's HTTP/2 read loop or WebSocket decoder can buffer entire payloads or accumulate fragments without proper size limits, potentially leading to denial-of-service conditions. CVE-2026-69203 points out that the HTTP/2 implementation does not enforce SETTINGS_MAX_CONCURRENT_STREAMS, allowing a single connection to open an unbounded number of streams. Additionally, CVE-2026-69202 highlights a flaw in HTTP/2 flow-control window replenishment, where bytes received from the network are used instead of bytes consumed by the application, enabling a hostile peer to send data faster than it can be processed. CVE-2026-69213 details how an unbounded queue for outbound HTTP/2 frames can be exploited by a peer to cause resource exhaustion.

HTTP/1.1 parsing also presents multiple risks. CVE-2026-69204, a Critical severity vulnerability, arises from Ember HTTP/1.1 not rejecting messages with both Transfer-Encoding and Content-Length headers, leading to differing framing rule interpretations between an intermediary and Ember. CVE-2026-69217, a High severity flaw, involves Ember's HTTP/1.1 parser accepting duplicate Content-Length headers and using the last value, which can be exploited if an intermediary selects a different occurrence. CVE-2026-69205, another High severity issue, describes incorrect handling of Transfer-Encoding values due to case-sensitive checks and platform-default charset decoding. CVE-2026-69216 points to an issue in the chunk decoder accepting leading plus or minus signs and improper handling of chunk-size tokens.

Client-side middleware is also affected. CVE-2026-69215 and CVE-2026-69214, both Medium severity, involve the CookieJar client middleware improperly handling domain matching and public suffixes, potentially allowing cookies to be sent to unintended hosts. CVE-2026-69212, a Medium severity vulnerability, describes the FollowRedirect client middleware stripping sensitive headers like Authorization and Cookie only when the authority changes, but not when the URI scheme changes (e.g., HTTPS to HTTP), potentially preserving credentials across insecure redirects. CVE-2026-69211, a Medium severity flaw, notes that ResponseCookie.render does not neutralize semicolons or control characters in cookie attributes, which could lead to injection issues if constructed from unvalidated input.

Authentication and resource handling vulnerabilities were also disclosed. CVE-2026-69208, a High severity vulnerability, affects the DigestAuth server middleware due to an inverted stale-nonce comparison, potentially allowing replay attacks. CVE-2026-69201, a Medium severity issue, involves ResourceService and WebjarService decoding URL path segments without properly rejecting percent-encoded slash or backslash separators, which could allow path traversal.

All disclosed vulnerabilities were addressed in Http4s versions 0.23.37 and 1.0.0-M48. Users are strongly advised to update to these patched versions to mitigate the risks associated with these numerous parsing, resource management, and security flaws. The coordinated disclosure of these 18 CVEs underscores the importance of thorough security auditing for complex network service implementations.

The batch of vulnerabilities affects Http4s versions prior to 0.23.35 and 1.0.0-M47. Patches are available in Http4s 0.23.37 and 1.0.0-M48.

Key vulnerabilities include:

• Critical: CVE-2026-69204 - HTTP/1.1 parser accepts messages with both Transfer-Encoding and Content-Length.
• High: CVE-2026-88975 - HTTP/2 read loop buffers entire payload before checking against SETTINGS_MAX_FRAME_SIZE.
• High: CVE-2026-69203 - HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS, allowing unbounded streams.
• High: CVE-2026-69209 - WebSocket decoder permits unbounded message buffering.
• Medium: CVE-2026-69215 - CookieJar client middleware uses unanchored substring checks for domain matching.
• Medium: CVE-2026-69212 - FollowRedirect client middleware preserves credentials across same-authority HTTP/HTTPS redirects.