Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGS_MAX_FRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a connection where Ember advertised 16 KiB and either complete or slowly stream it, causing up to 1024-fold memory amplification per connection before processFrame can reject the frame. The shared H2Connection.readLoop affects withHttp2 servers and clients, while HTTP/2-disabled configurations are unaffected, and the patch rejects oversized frames before buffering their payloads. This issue is fixed in versions 0.23.37 and 1.0.0-M48.
CVE-2026-88975
HIGHPre-NVD 7.57.5—Trending — 3 sources updated this week
EchelonGraph scoreMEDIUM confidence
This high-severity CVE scores 7.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.6%, top 52% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
Triggered by: NVD CVSS baseline
Sources: epss, secondary
7.5EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 7.5Exploit: None knownExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 7.5
- EG Score
- 7.5(medium)
- EG Risk
- 49(Track)EG Risk 49/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity75% × 45%Exploitation1% × 40%Automatability100% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 48%
- KEV
- Not listed
Published
September 15, 2026
Last Modified
September 16, 2026
Advisory Details (4)
Auto-updated Sep 15, 2026Patch available. Sources: github_commit, github_release, github.
github_release Patch Available
Release v1.0.0-M48 (http4s/http4s)
Patch available: http4s/http4s v1.0.0-M48 (pre-release)
https://github.com/http4s/http4s/releases/tag/v1.0.0-M48github_release Patch Available
Release v0.23.37 (http4s/http4s)
Patch available: http4s/http4s v0.23.37
https://github.com/http4s/http4s/releases/tag/v0.23.37github_commit Patch Available
commit 87cf334fa3f6 (http4s/http4s)
Patch available: http4s/http4s v0.23.37 (contains commit 87cf334fa3f6)
https://github.com/http4s/http4s/commit/87cf334fa3f608ef7d3eb359e71e037ba3336d29github Patch Available
Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE · Advisory · http4s/http4s · GitHub
https://github.com/http4s/http4s/security/advisories/GHSA-gq9p-f254-h286Vendor Advisories for CVE-2026-88975(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(3 across 1 ecosystem)
Maven(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| org.http4s:http4s-ember-core_2.12 | 0.10.0-M10 ... 0.23.9 (116 versions) | 0.23.37 | — |
| org.http4s:http4s-ember-core_2.13 | 0.10.0-M10 ... 0.23.9 (116 versions) | 0.23.37 | — |
| org.http4s:http4s-ember-core_3 | 0.22.0 ... 0.23.9 (60 versions) | 0.23.37 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 10× in last 7d / 10× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-18 22:53 UTCEG score recompute
- 2026-09-18 19:28 UTCEPSS rescore
- 2026-09-17 21:59 UTCEG score recompute
- 2026-09-17 19:32 UTCEPSS rescore
- 2026-09-16 15:26 UTCEG score recompute
- 2026-09-16 14:51 UTCEG score recompute
- 2026-09-16 14:09 UTCEPSS rescore
- 2026-09-15 20:39 UTCEG score recompute
- 2026-09-15 19:43 UTCEG score recompute
- 2026-09-15 19:42 UTCMITRE cvelistV5first tracked
Frequently asked(5)
What is CVE-2026-88975?
CVE-2026-88975 is a high vulnerability published on September 15, 2026. Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared length but waits to buffer the entire payload before comparing it with SETTINGSMAXFRAME_SIZE. An unauthenticated peer can declare a payload near 16 MiB on a…
When was CVE-2026-88975 disclosed?
CVE-2026-88975 was first published in the National Vulnerability Database on September 15, 2026, with the most recent update on September 16, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-88975 actively exploited?
CVE-2026-88975 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 51.6% of all scored CVEs.
What is the CVSS score of CVE-2026-88975?
CVE-2026-88975 has a CVSS v3 base score of 7.5 (NVD).
How do I remediate CVE-2026-88975?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-88975, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-88975
Is Your Infrastructure Affected by CVE-2026-88975?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.