CVE-2026-69217— Http4s: Ember Server accepts duplicate Content-Length headers
Quick assessment
Affected
http4s http4s
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Http4s 是用于 HTTP 服务的 Scala 接口。在 0.23.35 及之前版本以及 1.0.0-M47 之前的版本中，Ember 的 HTTP/1.1 解析器会接受重复的且值不同的 头，并采用最后一个值，而非拒绝该消息。当 Ember 服务器位于一个会选择不同 实例的保持连接（keep-alive）中间件之后时，未经身份验证的攻击者可以利用此缺陷实施 CL.CL 请求走私（request smuggling），从而绕过前端控制、捕获后续用户的请求头，或污染缓存。此外，当客户端作为代理为多个下游消费者提供服
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-69217
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Http4s: Ember Server accepts duplicate Content-Length headers
Source: CVE Program / CVE List V5
Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different occurrence, an unauthenticated attacker can create CL.CL request smuggling that bypasses front-end controls, captures a later user’s headers, or poisons a cache. The shared client parser can also misframe responses from a malicious or compromised upstream when the client acts as a proxy for multiple downstream consumers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-69217
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-69217
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-69217 (1)
Vendor Advisories for CVE-2026-69217 (1)
Vendor Pages for CVE-2026-69217 (2)
Same Patch Batch · http4s · 2026-09-15 · 18 CVEs total
| CVE-2026-69204 | 9.2 CRITICAL | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggl |
| CVE-2026-69205 | 8.7 HIGH | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-69208 | 7.5 HIGH | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-88975 | 7.5 HIGH | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME |
| CVE-2026-69202 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-69218 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69210 | 7.5 HIGH | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69213 | 7.5 HIGH | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69203 | 7.5 HIGH | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69209 | 7.5 HIGH | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-69214 | 6.8 MEDIUM | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain |
| CVE-2026-69215 | 6.8 MEDIUM | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-69201 | 5.9 MEDIUM | Http4s: ResourceService and Webjar Service path escape via percent-encoded separators |
| CVE-2026-69212 | 5.9 MEDIUM | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redire |
| CVE-2026-69206 | 5.9 MEDIUM | Http4s: DigestAuth allows replay of captured requests |
| CVE-2026-69216 | 5.4 MEDIUM | Http4s: Ember chunk parser lenience (TE.TE request smuggling) |
| CVE-2026-69211 | 4.8 MEDIUM | Http4s: Set-Cookie rendering does not escape attribute delimiters |
IV. Related Vulnerabilities
Same product: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same vendor: http4s
-
CVE-2026-88975
Http4s: Ember HTTP/2 buffers a frame's declared payload befo -
CVE-2026-69206
Http4s: DigestAuth allows replay of captured requests -
CVE-2026-69202
Http4s Ember HTTP/2: unbounded inbound body buffering -
CVE-2026-69218
Http4s Ember HTTP/2: unbounded continuation frame accumulati -
CVE-2026-69203
Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURREN
Same weakness: CWE-444
-
CVE-2026-69205
Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 -
CVE-2026-69216
Http4s: Ember chunk parser lenience (TE.TE request smuggling -
CVE-2026-69204
Http4s: Ember accepts Transfer-Encoding combined with Conten -
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Enc -
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Leng
V. Comments for CVE-2026-69217
No comments yet