CVE-2026-69216 Details
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data without re-encoding and interprets malformed chunk boundaries differently, an unauthenticated attacker can create TE.TE request smuggling that bypasses intermediary controls, poisons caches, or hijacks the request queue. The same response-path leniency can enable response smuggling against an ember-client used as a gateway when the upstream is malicious or compromised. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
A request smuggling vulnerability has been identified in the Http4s library, specifically in the Ember HTTP client and server components, prior to versions 0.23.35 and 1.0.0-M47. The issue arises because the chunk decoder in Ember's HTTP/1.1 implementation is lenient in parsing chunk sizes, allowing leading plus or minus signs and trimming whitespace, contrary to the RFC 9112 specification. This leniency can be exploited by an unauthenticated attacker to create TE.TE request smuggling scenarios that bypass intermediary controls, poison caches, or hijack request queues. Additionally, this vulnerability can be exploited in response smuggling attacks when the Ember client acts as a gateway to a compromised upstream server.
Users should upgrade to Http4s versions 0.23.35 or 1.0.0-M47, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0 | [email protected] | Source CodeVendor |
| https://github.com/http4s/http4s/releases/tag/v0.23.35 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| http4s | <= 0.23.34 (semver) >= 1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
| http4s-ember-core | <= 0.23.34 (semver) >= 1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |