Ember HTTP Request Smuggling (CL.TE) CVE-2025-65004

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Ember accepts the combination of and , leading to HTTP request smuggling (CL.TE request smuggling) CVE ID: CVE-2025-65004 Severity: Moderate Published By: rossbaker, on July 6 Mechanism: The HTTP/1.1 request parser in Ember does not reject messages that simultaneously carry both and headers. RFC 9112 Section 6.1 requires servers to treat such messages as malformed and close the connection. When an intermediary layer processes these requests according to the RFC's Content-Length (CL) priority rule, it parses the request body based on , creating a discrepancy with Ember's parsing logic, which results in request smuggling. Impact Scope Affected Packages and Versions (Maven): - 2.12: - 2.13: - 3: Fixed Versions: - 2.12 → - 2.13 → - 3 → Affected Scenarios: - Server-Side: When ember-server acts as an intermediary layer forwarding requests that contain both headers, it may lead to: - Frontend security bypass (smuggled requests bypassing the ACL layer) - Cross-origin request hijacking (request bodies being captured on shared backends) - Cache poisoning (smuggled responses being associated with subsequent requests) - Client-Side: ember-client uses the same parser in the response path. If an upstream server sends both headers, it can corrupt pooled connections. Preconditions: - Unauthenticated remote attacker (server-side) - ember-server acting as a keep-alive intermediary layer - The intermediary layer forwards requests containing both and - Malicious or controlled upstream (client-side) Remediation (Workarounds) The intermediary layer should strictly reject requests that contain both and The intermediary layer should buffer and re-encode the request body Disable backend keep-alive between the intermediary layer and Ember References RFC 9112 6.1: Transfer-Encoding RFC 9112 6.3: Message Body Length RFC 9112 8.1.2: Request Smuggling POC / Exploitation Code The original source does not include POC code or exploitation code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

Ember HTTP Request Smuggling (CL.TE) CVE-2025-65004

More from this source