CVE-2026-69217: Http4s: Ember Server accepts duplicate Content-Length headers
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different occurrence, an unauthenticated attacker can create CL.CL request smuggling that bypasses front-end controls, captures a later user’s headers, or poisons a cache. The shared client parser can also misframe responses from a malicious or compromised upstream when the client acts as a proxy for multiple downstream consumers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4s/Ember Serverto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4s/Ember Serverto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which deployments are realistically exposed to request smuggling?
Ember servers are exposed when they sit behind a keep-alive intermediary that chooses a different duplicate Content-Length value than Ember. This discrepancy can allow an unauthenticated attacker to bypass front-end controls, capture a later user's headers, or poison a cache.
What does an attacker need to exploit the server-side issue?
The attacker needs network access to send a crafted HTTP/1.1 request containing differing duplicate Content-Length headers. No authentication or user interaction is required, but exploitation depends on a front-end keep-alive intermediary parsing the duplicate headers differently.
Are proxying clients also affected?
Yes. The shared client parser can misframe responses from a malicious or compromised upstream when the client proxies responses to multiple downstream consumers.
What versions contain the fix?
The issue is fixed in versions 0.23.35 and 1.0.0-M47. Versions before those releases are affected.