Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-69210
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 14:17 UTC · Revision 1
Source evidence
Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
core-osv · Original sourcePublished 15 Sept 2026, 19:19 UTC
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
osv:CVE-2026-69210
Complete source record
{
"id": "bc7876f09e099c4f405df764fa77ce5cc1f793c1eba89c239b32a0e2874fd153",
"url": "https://osv.dev/vulnerability/CVE-2026-69210",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Http4s: WebSocket decoder accepts negative length, causing infinite decode loop",
"summary": "Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.",
"evidence": "osv:CVE-2026-69210",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-69210",
"aliases": [
"CVE-2026-69210",
"GHSA-3j86-pj9g-jchr"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/http4s/http4s",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
},
{
"introduced": "756ce63aee681c5b632bbeafe0b8fde2f3d237f4"
},
{
"fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
},
{
"fixed": "c7d3ef90dc2ed1cd464968ab1b34f2f1762ddae2"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.23.35"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M47"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "c7d3ef90dc2ed1cd464968ab1b34f2f1762ddae2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.23.35"
},
{
"range": [
{
"fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.0.0-M47"
}
]
}
}
],
"versions": [
"v1.0.0-M46",
"v0.23.34",
"v0.23.33",
"v1.0.0-M45",
"v0.23.32",
"v0.23.31",
"v1.0.0-M44",
"v0.23.30",
"v1.0.0-M43",
"v1.0.0-M42",
"v0.23.29",
"v0.23.28",
"v0.23.27",
"v1.0.0-M41",
"v0.23.26",
"v0.23.25",
"v0.23.24",
"v0.23.23",
"v1.0.0-M40",
"v0.23.22",
"v0.23.20",
"v0.23.19",
"v0.23.19-RC2",
"v0.23.19-RC1",
"v1.0.0-M39",
"v0.23.18",
"v1.0.0-M37",
"v0.23.16",
"v1.0.0-M36",
"v0.23.15",
"v1.0.0-M35",
"v0.23.14",
"v1.0.0-M34",
"v0.23.13",
"v1.0.0-M33",
"v0.23.12",
"v1.0.0-M32",
"v0.23.11",
"v1.0.0-M31",
"v0.23.10",
"v0.23.9",
"v0.23.8",
"v1.0.0-M30",
"v0.23.7",
"v1.0.0-M29",
"v0.23.6",
"v0.23.5",
"v1.0.0-M28",
"v0.23.3",
"v1.0.0-M26",
"v0.23.2",
"v1.0.0-M24",
"v0.23.1",
"v0.23.0",
"v1.0.0-M22",
"v0.23.0-M1",
"v1.0.0-M21",
"v1.0.0-M20",
"v1.0.0-M19",
"v1.0.0-M17",
"v1.0.0-M16",
"v1.0.0-M15",
"v1.0.0-M13",
"v1.0.0-M12",
"v1.0.0-M11",
"v1.0.0-M10",
"v1.0.0-M9",
"v1.0.0-M8",
"v1.0.0-M7",
"v1.0.0-M6",
"v1.0.0-M5",
"v1.0.0-M4",
"v1.0.0-M3",
"v1.0.0-M2",
"v1.0.0-M1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69210.json"
}
}
],
"modified": "2026-10-28T02:30:29.589612103Z",
"provider": "osv",
"references": [
"https://github.com/http4s/http4s/releases/tag/v0.23.35",
"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69210.json",
"https://github.com/http4s/http4s/security/advisories/GHSA-3j86-pj9g-jchr",
"https://nvd.nist.gov/vuln/detail/CVE-2026-69210",
"https://github.com/http4s/http4s/commit/c7d3ef90dc2ed1cd464968ab1b34f2f1762ddae2"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1284",
"CWE-835"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69210.json"
}
},
"related_cves": [
{
"value": "CVE-2026-69210",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496250,
"published_at": "2026-09-15T19:19:04.868+00:00"
}