Executive brief
Http4s Ember is an HTTP server and client library used in Scala applications. The library's HTTP/1.1 parser fails to reject requests containing both Transfer-Encoding and Content-Length headers, a violation of RFC 9112. When deployed behind a proxy that forwards both headers and prioritizes Content-Length for framing, an attacker can perform request smuggling attacks to bypass security controls, hijack user sessions, or poison cached responses.
Technical details
The vulnerability is an inconsistent HTTP request interpretation (CWE-444) in Http4s Ember's HTTP/1.1 parser. RFC 9112 §6.1 requires servers to reject—and close the connection on—any message carrying both a Transfer-Encoding and Content-Length header. Ember's parser fails to enforce this requirement, accepting both headers. When Ember is deployed behind a reverse proxy or HTTP intermediary that follows RFC guidance by stripping Transfer-Encoding and framing the message body according to Content-Length, the two systems interpret message boundaries differently. An attacker can send a crafted request with both headers to an intermediary; the intermediary frames the body by Content-Length (short), while Ember frames by chunked encoding (long), leaving extra attacker-controlled bytes in the connection buffer. On a keep-alive connection, this buffer overflow contaminates the next request, enabling request smuggling. Attack requires network access to the intermediary (unauthenticated) and a backend keep-alive connection to Ember. Patched versions (0.23.35, 1.0.0-M47, and later) reject messages with both headers. No patches for 0.23.34 or 1.0.0-M1–M46 are available; users must upgrade.
Affected products
- http4s http4s-ember-core_2.12 <= 0.23.34
- http4s http4s-ember-core_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-ember-core_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-09-15: advisory: Reviewed and published to GitHub Advisory Database
- 2026-07-06: patched: Patched versions released: 0.23.35, 1.0.0-M47