CVE-2025-60216 Ember Chunked Parsing Looseness (TE.TE Request Smuggling)

Vulnerability Summary: Ember Chunked Parsing Leniency (TE.TE Request Smuggling) Vulnerability Overview Vulnerability Name: Ember Chunked Parsing Leniency (TE.TE Request Smuggling) CVE ID: CVE-2025-60216 Severity Level: Medium (CVSS v3.1 Score 5.4/10) Vulnerability Type: HTTP Request Smuggling (Request Smuggling, TE.TE) Root Cause: Ember's chunked decoder is overly lenient when parsing chunked bodies—it allows leading/trailing whitespace, accepts a leading or sign, and its parsing of chunk boundaries is inconsistent with RFC9112 §7.1. This causes a discrepancy in how intermediate proxies and Ember frame requests, leading to TE.TE request smuggling. Scope of Impact Affected Package: - Version 2.12 (Maven): Affected versions ≤ 0.23.34 - Version 2.13 (Maven): Affected versions ≤ 0.23.34 and ≥ 1.0.0-M1 and ≤ 1.0.0-M46 - Version 3 (Maven): Affected versions ≤ 0.23.34 Affected Scenarios: - Server-side: Request smuggling can occur when ember-server acts as the origin and is located behind an intermediate proxy that forwards the request body but re-interprets malformed chunk sizes. - Client-side: The same leniency exists on the response path for ember-client, enabling response smuggling when http4s is used as a gateway (requires a malicious or compressed upstream, rather than an anonymous remote client). Preconditions: - Unauthenticated remote attacker (server-side) - ember-server acts as the origin, positioned behind an intermediate proxy that re-encodes the request body - Malicious or compressed upstream (client-side) - The intermediate proxy/upstream does not re-encode chunked bodies when forwarding them, and its handling of prefixes, prefixes, and leading/trailing octal numbers is inconsistent with Ember's (rather than simply rejecting them). Remediation Fixed Versions: - 2.12 → Upgrade to 0.23.35 - 2.13 → Upgrade to 1.0.0-M47 - 3 → Upgrade to 0.23.35 Mitigations (Workarounds): - Intermediate proxies should strictly validate malformed chunk sizes. - Intermediate proxies should buffer and re-encode request bodies. POC / Exploit Code No POC code or exploit code block is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-60216 Ember Chunked Parsing Looseness (TE.TE Request Smuggling)

More from this source