CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser

Vulnerability ID: CVE-2026-69216
CVSS Score: 5.4
Published: 2026-09-15

An HTTP Request/Response Smuggling vulnerability (CVE-2026-69216) was identified in the Ember chunked transfer encoding decoder of the http4s Scala library. Due to parser leniency accepting sign prefixes, surrounding whitespace, and missing trailing CRLFs, attackers can bypass proxy security boundaries, poison shared caches, or hijack request queues.

TL;DR

A lenient HTTP chunk decoder in the http4s Ember server allows TE.TE request and response smuggling attacks when combined with strict upstream reverse proxies.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-444
• Attack Vector: Network (AV:N)
• CVSS Score: 5.4 (Medium)
• EPSS Score: Not yet calculated
• Impact: Request/Response Smuggling, Cache Poisoning, Bypass of Proxy Controls
• Exploit Status: None/PoC
• KEV Status: Not Listed

Affected Systems

• http4s Ember Core
• http4s Ember Server
• http4s Ember Client
• http4s-ember-core: < 0.23.35 (Fixed in: 0.23.35)
• http4s-ember-core: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: d78612a

restrict chunk-size to 1*HEXDIG, require CRLF after chunk-data

--- a/ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala\n+++ b/ember-core/shared/src/main/scala/org/http4s/ember/core/ChunkedEncoding.scala

Mitigation Strategies

• Upgrade the http4s dependencies to version 0.23.35 or 1.0.0-M47.
• Configure front-end proxies to normalize or re-encode chunked HTTP requests.
• Deploy HTTP/2 or HTTP/3 to avoid text-based HTTP/1.1 framing issues.

Remediation Steps:

1. Open your sbt build definition file (build.sbt).
2. Identify references to org.http4s dependencies, specifically http4s-ember-server or http4s-ember-client.
3. Update the version string to "0.23.35" or "1.0.0-M47" depending on your current major version branch.
4. Reload the project configuration and rebuild the binary artifact to ensure the updated library is packaged.
5. Redeploy the application and verify logs for potential ChunkedEncodingError exceptions indicating rejected malformed requests.

References

• GHSA-jrpm-956j-96jg: http4s-ember-core Request Smuggling
• Ember core fix commit d78612a5
• NVD - CVE-2026-69216
• http4s Release v0.23.35
• http4s Release v1.0.0-M47

Read the full report for CVE-2026-69216 on our website for more details including interactive diagrams and full exploit analysis.