{"metadata": {"vulnerability": "CVE-2026-69213", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-03T16:57:50.125Z", "date_only": false, "value": "2026-08-03T16:57:50.125Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-69213", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-15T19:08:21.856Z", "date_only": false, "value": "2026-09-15T19:08:21.856Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-69213", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-15T19:08:21.856Z", "date_only": false, "value": "2026-09-15T19:08:21.856Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-69213", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T19:17:38.317Z", "date_only": false, "value": "2026-09-15T19:17:38.317", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69213", "record": "FKIE_CVE-2026-69213", "field": "published"}, {"timestamp": "2026-09-15T20:00:36Z", "date_only": false, "value": "2026-09-15T20:00:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8F3Q-3JMV-7PRW", "record": "GHSA-8F3Q-3JMV-7PRW", "field": "published"}, {"timestamp": "2026-09-15T20:00:36Z", "date_only": false, "value": "2026-09-15T20:00:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8F3Q-3JMV-7PRW", "record": "GHSA-8F3Q-3JMV-7PRW", "field": "modified"}, {"timestamp": "2026-09-15T20:03:26.842Z", "date_only": false, "value": "2026-09-15T20:03:26.842056Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7l7nfi2e", "record": "CVE-2026-69213", "field": "creation_timestamp", "uuid": "eb3661ca-3978-41ba-a26f-86d34d488056", "content": "\ud83d\udfe0 CVE-2026-69213 - High (7.5)\n\nHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 seria...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69213/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7l7nfi2e"}, {"timestamp": "2026-09-16T13:32:29.057Z", "date_only": false, "value": "2026-09-16T13:32:29.057218Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/27956b315c2388b848451081f38450c3", "record": "CVE-2026-69213", "field": "creation_timestamp", "uuid": "7d21317e-a639-4267-b011-a7a3d12c9e93", "content": "# CVE-2026-69213: CVE-2026-69213: Uncontrolled Resource Consumption (DoS) in http4s Ember HTTP/2 Implementation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69213\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CVE-2026-69213) in the http4s Ember HTTP/2 server and client implementations allows unauthenticated remote attackers to trigger an OutOfMemoryError (OOM) and cause a Denial of Service (DoS) by exploiting unbounded outbound queues.\n\n## TL;DR\nEmber HTTP/2 in http4s fails to limit outbound response queues, permitting remote attackers to crash the JVM via OutOfMemoryError by flooding control frames while stalling socket reads.\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: No Public Exploit Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- org.http4s:http4s-ember-core\n- http4s Ember HTTP/2 Server\n- http4s Ember HTTP/2 Client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade to http4s v0.23.35, v1.0.0-M47, or newer versions\n- Disable HTTP/2 support in Ember server configuration if not strictly necessary\n- Utilize a reverse proxy or load balancer to handle HTTP/2 connection management and write timeouts\n\n**Remediation Steps:**\n1. Locate configuration files defining the http4s Ember server or client setup.\n2. Update your project build configuration (e.g., build.sbt) to reference version 0.23.35 or 1.0.0-M47 of 'http4s-ember-core' and related modules.\n3. If updating is not possible, disable HTTP/2 by removing calls to 'withHttp2' from the server builder.\n4. Deploy or configure an upstream proxy (like Nginx or AWS ALB) to enforce aggressive read and write timeout policies on HTTP/2 sessions.\n\n## References\n\n- [GitHub Security Advisory GHSA-8f3q-3jmv-7prw](https://github.com/http4s/http4s/security/advisories/GHSA-8f3q-3jmv-7prw)\n- [GitHub Fix Commit](https://github.com/http4s/http4s/commit/13fe24d6440bde2f1eb70121486cf59c278e6bae)\n- [Http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [Http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [CVE Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-69213)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-69213)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69213) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/27956b315c2388b848451081f38450c3"}, {"timestamp": "2026-09-17T16:42:58.154Z", "date_only": false, "value": "2026-09-17T16:42:58.154505Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69213", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-17T16:42:58.154Z", "date_only": false, "value": "2026-09-17T16:42:58.154505Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69213", "record": "FKIE_CVE-2026-69213", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-17T16:43:14.092Z", "date_only": false, "value": "2026-09-17T16:43:14.092Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-69213", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-17T16:43:14.092Z", "date_only": false, "value": "2026-09-17T16:43:14.092Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69213", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T17:16:46.607Z", "date_only": false, "value": "2026-09-17T17:16:46.607", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69213", "record": "FKIE_CVE-2026-69213", "field": "lastModified"}]}