Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-69209— Http4s: WebSocket decoder accepts unbounded message sizes

Quick assessment

Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Http4s 是一个用于 HTTP 服务的 Scala 接口。在 0.23.35 和 1.0.0-M47 之前的版本中，共享的 WebSocket 解码器允许无限制的消息缓冲，原因是分片重组过程在累积分片时没有任何大小限制，且 FrameTranscoder 可接受高达 Int.MaxValue 的声明长度。一个远程客户端只要完成与 http4s-blaze-server 或 http4s-ember-server 端点的 WebSocket 握手，就可以通过发送超大帧或分片消息来耗尽服务器内存。修复后的解码器通过

CVSS 7.5 · High

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1400

Affected Version Matrix 2

VendorProduct Version RangeStatus
http4s http4s < 0.23.35 affected
>= 1.0.0-M1, < 1.0.0-M47 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69209

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Http4s: WebSocket decoder accepts unbounded message sizes
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handshake against an http4s-blaze-server or http4s-ember-server endpoint can exhaust server memory with oversized frames or fragmented messages. The patched decoder applies a configurable 64 MiB default limit to individual frames and defragmented messages through EmberServerBuilder.withMaxWebSocketMessageSize. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
http4s http4s < 0.23.35 -

II. Public POCs for CVE-2026-69209

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69209

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-69209 (1)

Vendor Pages for CVE-2026-69209 (2)

Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total

CVE-2026-69204 9.2 CRITICAL Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl
CVE-2026-69217 8.7 HIGH Http4s: Ember Server accepts duplicate Content-Length headers
CVE-2026-69205 8.7 HIGH Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
CVE-2026-88975 7.5 HIGH Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME
CVE-2026-69202 7.5 HIGH Http4s Ember HTTP/2: unbounded inbound body buffering
CVE-2026-69218 7.5 HIGH Http4s Ember HTTP/2: unbounded continuation frame accumulation
CVE-2026-69210 7.5 HIGH Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
CVE-2026-69213 7.5 HIGH Http4s Ember HTTP/2: unbounded outbound frame queue
CVE-2026-69203 7.5 HIGH Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
CVE-2026-69208 7.5 HIGH Http4s: DigestAuth nonce map grows unbounded
CVE-2026-69214 6.8 MEDIUM Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
CVE-2026-69215 6.8 MEDIUM Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
CVE-2026-69201 5.9 MEDIUM Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
CVE-2026-69212 5.9 MEDIUM Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redire
CVE-2026-69206 5.9 MEDIUM Http4s: DigestAuth allows replay of captured requests
CVE-2026-69216 5.4 MEDIUM Http4s: Ember chunk parser lenience (TE.TE request smuggling)
CVE-2026-69211 4.8 MEDIUM Http4s: Set-Cookie rendering does not escape attribute delimiters

IV. Related Vulnerabilities

Same product: http4s
Same vendor: http4s
Same weakness: CWE-400

V. Comments for CVE-2026-69209

No comments yet

Leave a comment