CVE-2026-69204: Http4s Ember Request Smuggling Vulnerability

CVE-2026-69204 Overview

CVE-2026-69204 is an HTTP Request Smuggling vulnerability [CWE-444] in http4s, a Scala interface for HTTP services. The Ember HTTP/1.1 implementation fails to reject messages containing both Transfer-Encoding and Content-Length headers. This ambiguity allows an intermediary and Ember to select different body framing rules, enabling desynchronization attacks. Affected versions include all releases prior to 0.23.35 and 1.0.0-M47.

Critical Impact
An unauthenticated network attacker can smuggle requests through keep-alive intermediaries, bypass access controls, poison caches, or hijack victim requests when ember-server sits behind a proxy that frames by Content-Length.

Affected Products

http4s ember-server versions prior to 0.23.35
http4s ember-client versions prior to 0.23.35
http4s milestone releases prior to 1.0.0-M47

Discovery Timeline

2026-09-15 - CVE-2026-69204 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-69204

Vulnerability Analysis

The vulnerability resides in the shared Ember HTTP/1.1 parser located at ember-core/shared/src/main/scala/org/http4s/ember/core/Parser.scala. When a request or response contains both Transfer-Encoding: chunked and Content-Length headers, RFC 9112 requires the receiver to either reject the message or ignore Content-Length and use chunked framing. Ember failed to enforce this rule, creating divergent parsing behavior between Ember and any intermediary in front of it.

Attackers exploit this parser disagreement to inject a second request that the front-end proxy treats as part of the first request body, while Ember treats it as a distinct request. The impact ranges from access-control bypass and cache poisoning to attaching attacker-controlled request prefixes onto legitimate victim requests.

Root Cause

The root cause is missing input validation in the Ember header parser. The parser accepted concurrent presence of Transfer-Encoding and Content-Length without raising a framing error, violating HTTP/1.1 message framing requirements defined in RFC 9112.

Attack Vector

Exploitation requires network access to an ember-server deployed behind a keep-alive intermediary that forwards both headers and prioritizes Content-Length framing. On the client side, a malicious or compromised upstream can send both headers to desynchronize an ember-client connection. No authentication or user interaction is required.

text

     case object UnsupportedTransferEncoding extends Exception with NoStackTrace {
       override val getMessage = "UnsupportedTransferEncoding"
     }
+    case object ContentLengthAndTransferEncoding extends Exception with NoStackTrace {
+      override val getMessage = "ContentLengthAndTransferEncoding"
+    }
     final case class ParseHeadersError(cause: Throwable)
         extends Exception(
           s"Encountered Error Attempting to Parse Headers - ${cause.getMessage}",

Source: http4s security patch commit 9feaf86. The patch introduces a new ContentLengthAndTransferEncoding exception raised during header parsing to reject conflicting framing headers.

Detection Methods for CVE-2026-69204

Indicators of Compromise

HTTP requests reaching ember-server that contain both Transfer-Encoding and Content-Length headers in the same message.
Unexpected 400-class parser errors or connection resets originating from ember-client after upstream responses.
Backend request logs showing pipelined or partial requests whose method or path prefix does not match the front-end proxy log.

Detection Strategies

Inspect intermediary and application logs for header-pair anomalies where both framing headers appear in a single HTTP message.
Correlate front-end proxy access logs with ember-server request logs to identify request count or URL mismatches indicative of smuggling.
Deploy WAF or reverse-proxy rules that flag or block requests containing both Transfer-Encoding and Content-Length.

Monitoring Recommendations

Monitor cache infrastructure for unexpected entries poisoned with attacker-controlled content.
Alert on sudden increases in HTTP parser exceptions in http4s application telemetry.
Track keep-alive connection reuse metrics for anomalous request-per-connection ratios.

How to Mitigate CVE-2026-69204

Immediate Actions Required

Upgrade http4s to 0.23.35 or 1.0.0-M47 on all services using ember-server or ember-client.
Audit all HTTP intermediaries in front of ember-server to confirm they normalize or reject conflicting framing headers.
Review recent access and cache logs for evidence of request smuggling attempts.

Patch Information

The fix is delivered in http4s v0.23.35 and http4s v1.0.0-M47. Full technical details are available in GitHub Security Advisory GHSA-8h4c-x2wg-6xp8. The patch adds a ContentLengthAndTransferEncoding parse exception that rejects any HTTP/1.1 message combining both framing headers.

Workarounds

Configure the upstream intermediary to strip or reject messages containing both Transfer-Encoding and Content-Length before they reach ember-server.
Disable HTTP keep-alive at the intermediary if patching cannot be performed immediately, accepting the performance tradeoff.
Restrict ember-client to trusted upstream endpoints until the client library is upgraded.

bash

# Example sbt dependency upgrade
libraryDependencies ++= Seq(
  "org.http4s" %% "http4s-ember-server" % "0.23.35",
  "org.http4s" %% "http4s-ember-client" % "0.23.35"
)