CVE-2026-69205— Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Quick assessment
Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Http4s 是一个用于 HTTP 服务的 Scala 接口。在 0.23.35 和 1.0.0-M47 之前，Ember 中的 方法对 头的值采用大小写敏感的子串匹配，并使用平台默认字符集解码头部字节。这导致诸如 "Chunked" 这样的合法值无法被正确识别，而诸如 "notchunked" 这样的非法值却被错误地接受；此外，当使用 UTF-8 编码时，Unicode 大小写折叠（case folding）可能导致凯尔文符号（Kelvin sign）的字节序列被误判为匹配项。因此，遵循 RFC 规定的令牌（to
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69205
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69205
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69205
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69205 (1)
Vendor Advisories for CVE-2026-69205 (1)
Vendor Pages for CVE-2026-69205 (2)
Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total
| CVE-2026-69204 | 9.2 CRITICAL | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl |
| CVE-2026-69217 | 8.7 HIGH | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69208 | 7.5 HIGH | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-88975 | 7.5 HIGH | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME |
| CVE-2026-69202 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69210 | 7.5 HIGH | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69213 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69203 | 7.5 HIGH | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69209 | 7.5 HIGH | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69214 | 6.8 MEDIUM | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69215 | 6.8 MEDIUM | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69201 | 5.9 MEDIUM | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69212 | 5.9 MEDIUM | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redire |
| CVE-2026-69206 | 5.9 MEDIUM | Http4s: DigestAuth allows replay of captured requests |
| CVE-2026-69216 | 5.4 MEDIUM | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | 4.8 MEDIUM | Http4s: Set-Cookie rendering does not escape attribute delimiters |
IV. Related Vulnerabilities
Same product: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same vendor: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same weakness: CWE-444
-
CVE-2026-69217
Http4s: Ember Server accepts duplicate Content-Length header -
CVE-2026-69216
Http4s: Ember chunk parser lenience (TE.TE request smuggling -
CVE-2026-69204
Http4s: Ember accepts Transfer-Encoding combined with Conten -
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Enc -
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Leng
V. Comments for CVE-2026-69205
No comments yet