Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-69204: http4s Ember may let attackers bypass controls

CVE-2026-69204 · published 1 month ago

Summary

Versions of the http4s Ember library before the latest updates can accept web requests that contain two conflicting size indicators. This can let an attacker sneak extra requests past firewalls or cache systems, and may cause mixed or broken responses. Upgrade to version 0.23.35 or later (or 1.0.0-M47 or later) to stop this behavior.

What to do

Update org.http4s:http4s-ember-core_2.12 to version 0.23.35.
Update org.http4s:http4s-ember-core_2.13 to version 0.23.35.
Update org.http4s:http4s-ember-core_3 to version 0.23.35.
Update org.http4s:http4s-ember-core_2.13 to version 1.0.0-M47.
Update org.http4s:http4s-ember-core_3 to version 1.0.0-M47.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	http4s	http4s	< 0.23.35
maven	–	org.http4s:http4s-ember-core_2.12	<= 0.23.34 Fix: upgrade to 0.23.35
maven	–	org.http4s:http4s-ember-core_2.13	<= 0.23.34 >= 1.0.0-M1, <= 1.0.0-M46 Fix: upgrade to 0.23.35
maven	–	org.http4s:http4s-ember-core_3	<= 0.23.34 >= 1.0.0-M1, <= 1.0.0-M46 Fix: upgrade to 0.23.35
Maven	–	org.http4s:http4s-ember-core_2.12	< 0.23.35 Fix: upgrade to 0.23.35
Maven	–	org.http4s:http4s-ember-core_2.13	< 0.23.35 >= 1.0.0-M1, < 1.0.0-M47 Fix: upgrade to 0.23.35
Maven	–	org.http4s:http4s-ember-core_3	< 0.23.35 >= 1.0.0-M1, < 1.0.0-M47 Fix: upgrade to 0.23.35

Original advisory text

Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69204... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-69204 Vendor Advisory
https://github.com/http4s/http4s/releases/tag/v0.23.35 URL
https://github.com/http4s/http4s/security/advisories/GHSA-8h4c-x2wg-6xp8 Vendor Advisory
https://github.com/http4s/http4s/commit/9feaf8677951a52af906ae9664ff6f0543d9d810 Patch
https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 URL
https://github.com/http4s/http4s Product
https://github.com/advisories/GHSA-8h4c-x2wg-6xp8

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Timeline

Published15 Sep 2026

Updated4 Nov 2026

First seen15 Sep 2026

Sources

CVE-2026-69204 · NVD

CVE-2026-69204 · MITRE

GHSA-8h4c-x2wg-6xp8 · GHSA

GHSA-8h4c-x2wg-6xp8 · OSV

CVE-2026-69204 · OSV

Track software like this

Free during beta