criticalCVE-2026-69204Sep 15, 2026

CVE-2026-69204: http4s Ember CL.TE HTTP Request Smuggling

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

http4s Ember's HTTP/1.1 parser accepted requests that carried both Transfer-Encoding and Content-Length at the same time, letting an attacker smuggle a hidden request through a reverse proxy and…

Packageorg.http4s:http4s-ember-core_2.12
Ecosystemmaven
Affected<= 0.23.34
Fixed in0.23.35
CVE-2026-69204: http4s Ember CL.TE HTTP Request Smuggling

The problem

Ember's HTTP/1.1 parser in ember-core did not reject messages that carry both Transfer-Encoding: chunked and Content-Length. RFC 9112 §6.3.3 requires a server to treat this combination as a framing error and drop the connection.

When Ember sits behind a proxy that forwards both headers and frames the body by Content-Length, the two sides parse different request boundaries. An attacker can use this gap to smuggle a second request prefix past the proxy's auth and ACL layer, hijack another user's in-flight request on a shared keep-alive socket, or poison a caching proxy's response queue.

Proof of concept

A working proof-of-concept for CVE-2026-69204 in org.http4s:http4s-ember-core_2.12, with the exact payload below.

http
POST /api/data HTTP/1.1
Host: target.example
Content-Length: 6
Transfer-Encoding: chunked
Connection: keep-alive

0

GET /admin HTTP/1.1
Host: target.example
Content-Length: 10

smuggled=1

The proxy reads Content-Length: 6, consumes 0\r\n\r\n (6 bytes), and forwards the remainder as a fresh byte stream. Ember ignores Content-Length when Transfer-Encoding: chunked is present, so it reads the chunked body (the 0\r\n\r\n terminator marks an empty chunk) and then treats the trailing GET /admin ... bytes as the next pipelined request on the same connection, reaching the backend without ever passing the proxy's access check.

The patch adds an explicit rejection in ember-core/src/main/scala/org/http4s/ember/core/Parser.scala: when header parsing finds both Transfer-Encoding and Content-Length present on an incoming request, the parser now returns an error and closes the connection, matching the RFC 9112 §6.3.3 MUST requirement.

Root cause is CWE-444 (Inconsistent Interpretation of HTTP Requests).

The fix

Upgrade http4s-ember-core (and http4s-ember-server / http4s-ember-client) to **0.23.35** or **1.0.0-M47**. If an immediate upgrade is not possible, configure the intermediary to reject or rewrite any request that contains both Transfer-Encoding and Content-Length, or disable keep-alive on the backend connection between the proxy and Ember.

Reported by reardonj and ERobertGII.

References: [1][2][3][4][5]

Related research