DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69216: CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser

#security #cve #cybersecurity

CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser

Vulnerability ID: CVE-2026-69216
CVSS Score: 5.4
Published: 2026-09-15

An HTTP Request/Response Smuggling vulnerability (CVE-2026-69216) was identified in the Ember chunked transfer encoding decoder of the http4s Scala library. Due to parser leniency accepting sign prefixes, surrounding whitespace, and missing trailing CRLFs, attackers can bypass proxy security boundaries, poison shared caches, or hijack request queues.

TL;DR

A lenient HTTP chunk decoder in the http4s Ember server allows TE.TE request and response smuggling attacks when combined with strict upstream reverse proxies.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-444
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.4 (Medium)
  • EPSS Score: Not yet calculated
  • Impact: Request/Response Smuggling, Cache Poisoning, Bypass of Proxy Controls
  • Exploit Status: None/PoC
  • KEV Status: Not Listed

Affected Systems

  • http4s Ember Core
  • http4s Ember Server
  • http4s Ember Client
  • http4s-ember-core: < 0.23.35 (Fixed in: 0.23.35)
  • http4s-ember-core: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: d78612a

restrict chunk-size to 1*HEXDIG, require CRLF after chunk-data

--- a/ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala\n+++ b/ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the http4s dependencies to version 0.23.35 or 1.0.0-M47.
  • Configure front-end proxies to normalize or re-encode chunked HTTP requests.
  • Deploy HTTP/2 or HTTP/3 to avoid text-based HTTP/1.1 framing issues.

Remediation Steps:

  1. Open your sbt build definition file (build.sbt).
  2. Identify references to org.http4s dependencies, specifically http4s-ember-server or http4s-ember-client.
  3. Update the version string to "0.23.35" or "1.0.0-M47" depending on your current major version branch.
  4. Reload the project configuration and rebuild the binary artifact to ensure the updated library is packaged.
  5. Redeploy the application and verify logs for potential ChunkedEncodingError exceptions indicating rejected malformed requests.

References

Read the full report for CVE-2026-69216 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)