Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala concatenates HEADERS and CONTINUATION frame fragments and decodes them into a single List, but maxHeaderSize accounting does not include indexed headers or HPACK per-header overhead. A small compressed header block can therefore expand into a much larger decoded representation that remains in memory for processing. Servers exposed to untrusted HTTP/2 traffic and clients directed to an untrusted HTTP/2 server are affected, and concurrent malicious connections can exhaust the process heap. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-54556 Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Embe… https://www.cve.org/CVERecord?id=CVE-2026-54556
Post summary
The text announces CVE‑2026‑54556 as a denial‑of‑service vulnerability caused by unauthenticated HTTP/2 peers in Http4s, detailing the affected versions and the nature of the OOM attack.
🔴 http4s, Denial of Service (HPACK Bomb), #CVE-2026-54556 (High) -DC-Aug2026-1926 https://dailycve.com/http4s-denial-of-service-hpack-bomb-cve-2026-54556-high-dc-aug2026-1926/
Post summary
CVE-2026-54556, a high‑severity DoS flaw in http4s caused by an HPACK Bomb, is announced but lacks explicit technical details, PoC, or exploit information.