{"id":"CVE-2026-69204","aliases":["EUVD-2026-79025","GHSA-8h4c-x2wg-6xp8"],"status":"published","title":"Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00574,"percentile":0.47753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-09-15T18:43:14Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.12","fixed_in":["0.23.35"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.13","fixed_in":["0.23.35","1.0.0-M47"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.http4s:http4s-ember-core_3","fixed_in":["0.23.35","1.0.0-M47"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.34"},{"fixed":"0.23.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.34"},{"fixed":"0.23.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.23.34"},{"fixed":"0.23.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"last_affected":"1.0.0-M46"},{"fixed":"1.0.0-M47"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"last_affected":"1.0.0-M46"},{"fixed":"1.0.0-M47"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.34","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.0-M1","0.22.0-M2","0.22.0-M3","0.22.0-M4","0.22.0-M5","0.22.0-M6","0.22.0-M7","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.34","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.0-M1","0.22.0-M2","0.22.0-M3","0.22.0-M4","0.22.0-M5","0.22.0-M6","0.22.0-M7","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.22.0","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M47"}]}],"versions":["1.0.0-M10","1.0.0-M11","1.0.0-M13","1.0.0-M14","1.0.0-M15","1.0.0-M16","1.0.0-M17","1.0.0-M18","1.0.0-M19","1.0.0-M2","1.0.0-M20","1.0.0-M21","1.0.0-M22","1.0.0-M23","1.0.0-M24","1.0.0-M25","1.0.0-M27","1.0.0-M28","1.0.0-M29","1.0.0-M3","1.0.0-M30","1.0.0-M31","1.0.0-M32","1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M4","1.0.0-M40","1.0.0-M41","1.0.0-M42","1.0.0-M43","1.0.0-M44","1.0.0-M45","1.0.0-M46","1.0.0-M5","1.0.0-M6","1.0.0-M7","1.0.0-M8","1.0.0-M9"]},{"source":"osv","ecosystem":"Maven","package":"org.http4s:http4s-ember-core_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M47"}]}],"versions":["1.0.0-M22","1.0.0-M23","1.0.0-M24","1.0.0-M25","1.0.0-M27","1.0.0-M28","1.0.0-M29","1.0.0-M30","1.0.0-M31","1.0.0-M32","1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M40","1.0.0-M41","1.0.0-M42","1.0.0-M43","1.0.0-M44","1.0.0-M45","1.0.0-M46"]}],"products":[{"vendor":"http4s","product":"http4s"}],"references":[{"url":"https://github.com/http4s/http4s/security/advisories/GHSA-8h4c-x2wg-6xp8","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/http4s/http4s/commit/9feaf8677951a52af906ae9664ff6f0543d9d810","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/http4s/http4s/releases/tag/v0.23.35","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-8h4c-x2wg-6xp8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69204.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69204","tags":["advisory"]},{"url":"https://github.com/http4s/http4s","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-69204","title":"Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","status":"published","published":"2026-09-15T18:43:14.85Z","modified":"2026-09-15T19:00:49.739Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T13:50:27.582139Z"}],"euvd":[{"id":"EUVD-2026-79025","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","status":"published","published":"2026-09-15T18:43:14Z","modified":"2026-09-15T19:00:49Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:28:17.333425Z"}],"ghsa":[{"id":"GHSA-8h4c-x2wg-6xp8","title":"Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)","description":"## Summary\n\nEmber's HTTP/1.1 request parser does not reject a message that carries both a\n`Transfer-Encoding` and a `Content-Length` header. RFC 9112 §6.1 requires a\nserver to treat such a message as a framing error and close the connection.\nAn intermediary that follows the RFC's CL-strip-and-forward path (or that\nprioritises `Content-Length`) will frame the body differently from Ember,\nenabling HTTP request smuggling (CL.TE).\n\n## Impact\n\n### Server\n\nRequest smuggling when ember-server is an origin behind an intermediary that\nforwards both headers over a keep-alive backend connection and frames by\n`Content-Length` while Ember frames by chunked:\n\n- Front-end security bypass: the smuggled request reaches paths the\n  intermediary's ACL/auth layer would have blocked, with attacker-chosen\n  method and headers.\n- Cross-user request hijack: a dangling smuggled prefix concatenates with the\n  next victim's request on the shared backend socket, capturing its headers.\n- Cache poisoning: the smuggled response is associated with the next request\n  key in a caching proxy.\n\n### Client\n\nember-client shares the same parser on the response path. An upstream that\nsends both headers can desync a pooled client connection. This requires a\nmalicious or compromised upstream.\n\n## Preconditions\n\n- Unauthenticated remote attacker (server)\n- ember-server as origin behind a keep-alive intermediary\n- Intermediary forwards a request carrying both `Transfer-Encoding` and\n  `Content-Length` (RFC says it MAY reject; many forward) and frames by\n  `Content-Length`\n- Malicious or compromised upstream (client)\n\n## Workarounds\n\n- Intermediary strictly rejects requests carrying both `Transfer-Encoding`\n  and `Content-Length`\n- Intermediary buffers and re-encodes request bodies\n- Disable backend keep-alive between the intermediary and Ember","status":"published","published":"2026-09-15T19:53:44Z","modified":"2026-09-15T19:53:44Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2026-69204","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","status":"published","published":"2026-09-15T19:17:37.58Z","modified":"2026-09-16T20:39:16.61Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-69204","title":"Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)","description":"Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.","status":"published","published":"2026-09-15T18:43:14.85Z","modified":"2026-10-28T02:31:13.136120428Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-8h4c-x2wg-6xp8","title":"Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)","description":"## Summary\n\nEmber's HTTP/1.1 request parser does not reject a message that carries both a\n`Transfer-Encoding` and a `Content-Length` header. RFC 9112 §6.1 requires a\nserver to treat such a message as a framing error and close the connection.\nAn intermediary that follows the RFC's CL-strip-and-forward path (or that\nprioritises `Content-Length`) will frame the body differently from Ember,\nenabling HTTP request smuggling (CL.TE).\n\n## Impact\n\n### Server\n\nRequest smuggling when ember-server is an origin behind an intermediary that\nforwards both headers over a keep-alive backend connection and frames by\n`Content-Length` while Ember frames by chunked:\n\n- Front-end security bypass: the smuggled request reaches paths the\n  intermediary's ACL/auth layer would have blocked, with attacker-chosen\n  method and headers.\n- Cross-user request hijack: a dangling smuggled prefix concatenates with the\n  next victim's request on the shared backend socket, capturing its headers.\n- Cache poisoning: the smuggled response is associated with the next request\n  key in a caching proxy.\n\n### Client\n\nember-client shares the same parser on the response path. An upstream that\nsends both headers can desync a pooled client connection. This requires a\nmalicious or compromised upstream.\n\n## Preconditions\n\n- Unauthenticated remote attacker (server)\n- ember-server as origin behind a keep-alive intermediary\n- Intermediary forwards a request carrying both `Transfer-Encoding` and\n  `Content-Length` (RFC says it MAY reject; many forward) and frames by\n  `Content-Length`\n- Malicious or compromised upstream (client)\n\n## Workarounds\n\n- Intermediary strictly rejects requests carrying both `Transfer-Encoding`\n  and `Content-Length`\n- Intermediary buffers and re-encodes request bodies\n- Disable backend keep-alive between the intermediary and Ember","status":"published","published":"2026-09-15T19:53:44Z","modified":"2026-09-15T20:00:39.617163532Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}