{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "0.23.37"
              },
              {
                "introduced": "1.0.0-M1"
              },
              {
                "fixed": "1.0.0-M48"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "756ce63aee681c5b632bbeafe0b8fde2f3d237f4"
            },
            {
              "fixed": "73340be10836b95241ed2d7682b4da057b7b5ccb"
            },
            {
              "fixed": "2d62cbe12e8941ac4800a41fa45e132900b90caa"
            },
            {
              "fixed": "87cf334fa3f608ef7d3eb359e71e037ba3336d29"
            }
          ],
          "repo": "https://github.com/http4s/http4s",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-gq9p-f254-h286"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88975.json"
  },
  "details": "Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.",
  "id": "CVE-2026-88975",
  "modified": "2026-09-18T03:31:01.557818561Z",
  "published": "2026-09-15T19:31:25.221Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/releases/tag/v0.23.37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/releases/tag/v1.0.0-M48"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88975.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-gq9p-f254-h286"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88975"
    },
    {
      "type": "FIX",
      "url": "https://github.com/http4s/http4s/commit/87cf334fa3f608ef7d3eb359e71e037ba3336d29"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE"
}