CVE-2026-69205: Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s/ember (Ember HeaderP.parse)to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s/ember (Ember HeaderP.parse)to a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are most exposed to request smuggling?
Server paths where an RFC-compliant intermediary sits in front of an Http4s Ember service are exposed when the intermediary and Ember interpret Transfer-Encoding and Content-Length framing differently. This disagreement can enable request smuggling and its downstream effects, including access-control bypass, cross-user request hijacking, and cache poisoning.
What does an attacker need to exploit the server-side issue?
The vector is network-based and requires neither privileges nor user interaction. Exploitation depends on being able to send crafted requests through an intermediary whose Transfer-Encoding parsing differs from Ember's behavior.
Are Ember client gateways also affected?
Response smuggling through an ember-client gateway requires a malicious or compromised upstream. The provided information does not indicate that a trusted upstream alone can trigger this response-side scenario.
What versions address the issue?
Upgrade to Http4s 0.23.35 or 1.0.0-M47, which contain the fix. Versions prior to those releases are described as affected.