CVE-2026-69205 in Http4s
Summary
by MITRE • 09/15/2026
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
Http4s serves as a prominent functional HTTP library for Scala, providing robust interfaces for building web services. Within this ecosystem, the Ember server component handles low-level HTTP parsing and connection management. A critical vulnerability was identified in the header parsing logic of Ember prior to versions 0.23.35 and 1.0.0-M47. The core technical flaw resides in the HeaderP.parse method, which incorrectly processes the Transfer-Encoding header field. Specifically, the implementation utilizes a case-sensitive substring match rather than a strict token comparison as mandated by RFC standards. This deviation from standard HTTP parsing rules creates significant security implications because it allows for ambiguous interpretation of request framing mechanisms that are critical for distinguishing between different types of data transmission in HTTP/1.1 and HTTP/2 protocols.
The vulnerability manifests through three distinct technical failures. First, the parser fails to recognize valid Transfer-Encoding values such as Chunked due to its case-sensitive nature, leading to a failure in proper decoding or framing expectations. Second, it incorrectly accepts invalid values like notchunked because they contain the substring chunked, thereby bypassing validation checks that should reject malformed headers. Third, and most critically for security, the parser decodes header bytes using the platform default charset instead of enforcing ASCII encoding as required by RFC 7230. This allows Unicode case folding to occur during parsing; specifically, a byte sequence representing the Kelvin sign in UTF-8 can be interpreted as matching an ASCII token under certain locale settings. This discrepancy between how Ember parses headers and how standard-compliant intermediaries parse them creates a divergence in state that attackers can exploit.
The operational impact of this vulnerability is severe, primarily enabling HTTP Request Smuggling attacks categorized under the TE.CL or TE.0 variants. When a front-end proxy or load balancer adheres strictly to RFC standards while Ember misinterprets headers due to charset and case sensitivity issues, the two systems may disagree on where one request ends and another begins. This disagreement allows an attacker to smuggle malicious requests behind legitimate ones, effectively bypassing access control lists by hiding unauthorized actions within valid traffic streams. Furthermore, this ambiguity facilitates cross-user request hijacking, where a user's authenticated session can be manipulated or redirected without their knowledge. In environments utilizing caching mechanisms, the misinterpretation of headers can lead to cache poisoning attacks, where malicious content is stored and served to other users based on the smuggled requests.
While response smuggling through an Ember client gateway was also noted as a potential vector, it requires additional conditions such as a compromised or malicious upstream server, making it less directly exploitable in typical scenarios compared to request smuggling. The primary threat landscape involves attackers leveraging these parsing discrepancies to bypass security controls and manipulate backend services. To mitigate this risk, organizations running affected versions of Http4s must upgrade immediately to version 0.23.35 or later for the 0.23 series, or version 1.0.0-M47 and later for the main branch. These updates correct the header parsing logic to enforce strict ASCII encoding and case-insensitive token matching consistent with RFC specifications. Additionally, security teams should audit their infrastructure to ensure that all intermediaries in the request path are configured consistently regarding HTTP/1.1 framing rules to minimize the attack surface even if a single component has not yet been patched. This vulnerability aligns with CWE-20 Improper Input Validation and is associated with ATT&CK techniques related to Request Smuggling, highlighting the importance of strict adherence to protocol standards in web application frameworks.