http4s Ember CVE-2026-54556

HTTP/2 must be explicitly enabled in the http4s ember backend - deployments using HTTP/1.1 only, or using backends other than ember (e.g., blaze, netty-client), are entirely unaffected. For server-side exploitation the endpoint must be reachable from untrusted network traffic. For client-side exploitation the ember HTTP/2 client must be directed to connect to an attacker-controlled server that returns HPACK bomb response headers. No authentication is required by either party. The existing maxHeaderSize configuration parameter does not limit exploitation in vulnerable versions because it excludes indexed headers from its accounting. Attack requires only approximately five concurrent connections against a 2 GB JVM heap, with no special tooling beyond HTTP/2 frame crafting capability.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) correctly reflects that the attack is network-accessible and unauthenticated with high availability impact, while AT:P acknowledges a meaningful prerequisite: HTTP/2 must be explicitly enabled in the ember backend. No EPSS score was included in the source data, so exploitation probability cannot be independently quantified. The vulnerability is absent from CISA KEV and no public proof-of-concept has been identified, placing this in the theoretical-to-practical risk tier rather than confirmed active exploitation. Impact is purely availability - the JVM process crashes, denying service - with zero confidentiality or integrity exposure. The low concurrent-connection threshold (~5 connections on a 2 GB heap) makes the attack resource-efficient once a target is identified, so any deployment accepting untrusted HTTP/2 traffic should treat upgrade as urgent. The CVSS 4.0 AT:P signal is important: organizations that have not enabled HTTP/2 in ember are entirely unaffected and need not prioritize this finding.

An unauthenticated remote attacker sends approximately five concurrent HTTP/2 requests containing crafted HPACK bomb payloads - small HEADERS and CONTINUATION frames that reference indexed header table entries - to a vulnerable http4s ember server. Each connection triggers the Hpack decoder to expand a compact wire payload into a very large Scala List held in JVM heap; across five simultaneous connections the heap is exhausted, causing an OutOfMemoryError that crashes the server process. The HPACK bomb technique is well-documented from prior HTTP/2 server disclosures, making independent exploit development straightforward for an attacker familiar with HTTP/2 framing.