CVE-2026-69216: Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data without re-encoding and interprets malformed chunk boundaries differently, an unauthenticated attacker can create TE.TE request smuggling that bypasses intermediary controls, poisons caches, or hijacks the request queue. The same response-path leniency can enable response smuggling against an ember-client used as a gateway when the upstream is malicious or compromised. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are realistically exposed to request smuggling?
Exposure requires an affected Ember server behind an intermediary that forwards chunked requests without re-encoding them and parses malformed chunk boundaries differently. In that arrangement, an unauthenticated remote attacker may bypass intermediary controls, poison caches, or interfere with the request queue.
Is an Ember client deployment affected as well?
The response-path parsing leniency can enable response smuggling when an ember-client is used as a gateway and its upstream server is malicious or compromised. This scenario depends on the gateway receiving crafted malformed chunked responses from that upstream.
What must an attacker send to exploit the issue?
The attack relies on malformed chunked-message framing that Ember accepts because it trims the chunk-size token and permits leading plus or minus signs rather than requiring hexadecimal digits followed by CRLF. Successful smuggling also depends on a parsing discrepancy with an intermediary or, for the response path, a gateway upstream.
What versions contain the fix?
The issue is fixed in Http4s versions 0.23.35 and 1.0.0-M47. Deployments prior to those versions are affected according to the advisory.