{"metadata": {"vulnerability": "CVE-2026-69218", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-03T16:57:50.125Z", "date_only": false, "value": "2026-08-03T16:57:50.125Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-69218", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-15T19:22:57.407Z", "date_only": false, "value": "2026-09-15T19:22:57.407Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-69218", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-15T19:22:57.407Z", "date_only": false, "value": "2026-09-15T19:22:57.407Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-69218", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T20:01:08Z", "date_only": false, "value": "2026-09-15T20:01:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CP4Q-FQW9-4HF6", "record": "GHSA-CP4Q-FQW9-4HF6", "field": "published"}, {"timestamp": "2026-09-15T20:01:08Z", "date_only": false, "value": "2026-09-15T20:01:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CP4Q-FQW9-4HF6", "record": "GHSA-CP4Q-FQW9-4HF6", "field": "modified"}, {"timestamp": "2026-09-15T20:17:41.310Z", "date_only": false, "value": "2026-09-15T20:17:41.310", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69218", "record": "FKIE_CVE-2026-69218", "field": "published"}, {"timestamp": "2026-09-16T09:31:31.539Z", "date_only": false, "value": "2026-09-16T09:31:31.539502Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/1d7bf0359f0215ea04330c59b303d19c", "record": "CVE-2026-69218", "field": "creation_timestamp", "uuid": "c997b6b8-e159-4544-8110-ba33faea72a8", "content": "# CVE-2026-69218: CVE-2026-69218: Denial of Service via Unbounded HTTP/2 Continuation Frame Buffering in http4s Ember\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69218\n\n## Summary\nA critical resource exhaustion vulnerability exists in the http4s Ember HTTP/2 server and client implementations. By failing to limit the size or quantity of incoming HTTP/2 CONTINUATION frames, the engine allows unauthenticated remote attackers to exhaust JVM heap memory, causing a complete Denial of Service.\n\n## TL;DR\nUnbounded HTTP/2 CONTINUATION frames cause JVM heap exhaustion and DoS in http4s Ember.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s-ember-server\n- http4s-ember-client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade http4s library dependencies to patched versions (0.23.35 or 1.0.0-M47)\n- Deploy a reverse proxy such as Nginx or Envoy in front of http4s to handle the HTTP/2 frame layer\n- Apply strict request rate-limiting and connection limits at the edge firewall\n\n**Remediation Steps:**\n1. Identify all projects and microservices using org.http4s:http4s-ember-server or org.http4s:http4s-ember-client.\n2. Update build definitions (e.g., build.sbt) to use version 0.23.35 or 1.0.0-M47.\n3. Validate the fix by verifying that incoming headers exceeding configured limits trigger HTTP/2 EnhanceYourCalm (0xb) errors.\n4. Re-deploy the updated service instances and monitor JVM memory performance metrics.\n\n## References\n\n- [GHSA-cp4q-fqw9-4hf6: http4s Vulnerability Advisory](https://github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6)\n- [CVE-2026-69218 Record](https://www.cve.org/CVERecord?id=CVE-2026-69218)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69218) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/1d7bf0359f0215ea04330c59b303d19c"}, {"timestamp": "2026-09-17T16:46:52.034Z", "date_only": false, "value": "2026-09-17T16:46:52.034934Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69218", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-17T16:46:52.034Z", "date_only": false, "value": "2026-09-17T16:46:52.034934Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69218", "record": "FKIE_CVE-2026-69218", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-17T16:47:13.590Z", "date_only": false, "value": "2026-09-17T16:47:13.590Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-69218", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-17T16:47:13.590Z", "date_only": false, "value": "2026-09-17T16:47:13.590Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-69218", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T17:16:46.710Z", "date_only": false, "value": "2026-09-17T17:16:46.710", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-69218", "record": "FKIE_CVE-2026-69218", "field": "lastModified"}]}