THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-vmm3-xgcx-67hm (high) — http4s has HTTP/2 Denial of Service with Ember Backend

[GHSA] GHSA-vmm3-xgcx-67hm (high) — http4s has HTTP/2 Denial of Service with Ember Backend

highgithub_advisoriesPublished 2026-08-26

GHSA-vmm3-xgcx-67hm Severity: high CVE: CVE-2026-54556

http4s has HTTP/2 Denial of Service with Ember Backend

### Summary

http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers.

### Impact

Denial of Service: - Affects any http4s server running the ember bac

Indicators of compromise

c63fbff43dfe7e3bec25b789fd0a0027ec40ed62sha1
CVE-2026-54556cve

Original source: https://github.com/advisories/GHSA-vmm3-xgcx-67hm