Executive brief
Http4s Ember is a Scala HTTP server and client library used in applications to handle HTTP/1.1 connections. The library's header parser fails to correctly interpret the Transfer-Encoding header according to RFC standards, allowing attackers to desynchronize request framing between Ember and upstream intermediaries (like proxies or load balancers). This enables HTTP request smuggling attacks that can bypass security controls, hijack other users' requests and credentials, or poison caches.
Technical details
The vulnerability exists in Ember's HTTP/1.1 header parser, which uses a case-sensitive substring match (`hValue.contains("chunked")`) to detect chunked Transfer-Encoding. RFC 9112 §7 mandates case-insensitive comparison. Three parsing variants enable desync: (1) `Transfer-Encoding: Chunked` (capital C) is not recognized as chunked, causing Ember to fall back to Content-Length framing while compliant intermediaries use chunked framing; (2) `Transfer-Encoding: notchunked` triggers a false positive in the substring test; (3) UTF-8 decoding of header bytes can produce Unicode characters (e.g., U+212A KELVIN SIGN) that case-fold to ASCII letters, matching `chunked` unexpectedly. When Ember operates as an origin behind a keep-alive intermediary that respects RFC-compliant case-insensitive Transfer-Encoding handling, attackers can smuggle requests past the intermediary's ACL/auth, hijack subsequent victims' requests (exposing cookies/auth headers), or poison cached responses. Ember-client faces response smuggling risk when acting as a gateway to malicious upstreams. Patches are available in http4s-ember-core versions 0.23.35 and 1.0.0-M47.
Affected products
- http4s http4s-ember-core_2.12 ≤ 0.23.34
- http4s http4s-ember-core_2.13 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46
- http4s http4s-ember-core_3 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46
Timeline
- 2026-09-15: disclosed: Advisory published to GitHub Advisory Database
- 2026-09-15: patched: Fixes available in http4s-ember-core 0.23.35 and 1.0.0-M47