Maven/org.http4s:http4s-ember-core_2.12 CVE-2026-88975: high 7.5, EPSS 0.63%

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

Action: Upgrade org.http4s:http4s-ember-core_2.12 to 0.23.37 or later.

Affected

Fixed versions

Sources

• osv: GHSA-gq9p-f254-h286#Maven/org.http4s:http4s-ember-core_2.12
• https://github.com/http4s/http4s/security/advisories/GHSA-gq9p-f254-h286
• https://github.com/http4s/http4s/commit/87cf334fa3f608ef7d3eb359e71e037ba3336d29
• https://github.com/http4s/http4s
• https://github.com/http4s/http4s/releases/tag/v0.23.37
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M48

CVE-2026-88975 · published 2026-09-15T20:01:22Z · modified 2026-09-15T20:15:05.144198128Z · JSON