EUVD-2026-79192Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of service on servers built with the Ember backend. The flaw lies in WebSocket FrameTranscoder.bodyLength, which rejects extended payload lengths above Integer.MAX_VALUE but accepts negative 64-bit lengths; a remote client that completes a WebSocket handshake can send such a frame, and the decoder then returns an empty frame without advancing its input, so the decode loop spins forever while an ArrayBuffer grows without bound. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
We need produce JSON only. Need synthesize. Must follow all rules. We have CVE input. Need fill fields. We need be caref
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote atta
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensiti
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely expl
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a singl
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in Nonc
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5),
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - incl
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today