Is CVE-2026-69205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69205 being exploited in the wild.

How severe is CVE-2026-69205?

High severity, with a CVSS score of 8.7, published 15 September 2026.

Which products and versions are affected?

Http4s-Ember-Core ≤ 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

Is there a fix for CVE-2026-69205?

Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69205 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-69205?

Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69205: Http4s Ember HTTP request smuggling via Transfer-Encoding parsing

CVE-2026-69205 · Severity: high · CVSS 8.7 · Published 2026-09-15

Http4s Ember is a Scala HTTP server and client library used in applications to handle HTTP/1.1 connections. The library's header parser fails to correctly interpret the Transfer-Encoding header according to RFC standards, allowing attackers to desynchronize request framing between Ember and upstream intermediaries (like proxies or load balancers). This enables HTTP request smuggling attacks that can bypass security controls, hijack other users' requests and credentials, or poison caches.

Technologies: Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven), org.http4s:http4s-ember-core_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-69205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69205 being exploited in the wild.
How severe is CVE-2026-69205?: High severity, with a CVSS score of 8.7, published 15 September 2026.
Which products and versions are affected?: Http4s-Ember-Core ≤ 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.
Is there a fix for CVE-2026-69205?: Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69205 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-69205?: Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later

# set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle

org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later

# set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle

org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later

# set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle

Technical details

The vulnerability exists in Ember's HTTP/1.1 header parser, which uses a case-sensitive substring match (`hValue.contains("chunked")`) to detect chunked Transfer-Encoding. RFC 9112 §7 mandates case-insensitive comparison. Three parsing variants enable desync: (1) `Transfer-Encoding: Chunked` (capital C) is not recognized as chunked, causing Ember to fall back to Content-Length framing while compliant intermediaries use chunked framing; (2) `Transfer-Encoding: notchunked` triggers a false positive in the substring test; (3) UTF-8 decoding of header bytes can produce Unicode characters (e.g., U+212A KELVIN SIGN) that case-fold to ASCII letters, matching `chunked` unexpectedly. When Ember operates as an origin behind a keep-alive intermediary that respects RFC-compliant case-insensitive Transfer-Encoding handling, attackers can smuggle requests past the intermediary's ACL/auth, hijack subsequent victims' requests (exposing cookies/auth headers), or poison cached responses. Ember-client faces response smuggling risk when acting as a gateway to malicious upstreams. Patches are available in http4s-ember-core versions 0.23.35 and 1.0.0-M47.

Affected products

http4s http4s-ember-core_2.12 ≤ 0.23.34
http4s http4s-ember-core_2.13 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46
http4s http4s-ember-core_3 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46

Identifiers

CVE-2026-69205
GHSA-9998-894r-fwvr

Timeline

2026-09-15: disclosed: Advisory published to GitHub Advisory Database
2026-09-15: patched: Fixes available in http4s-ember-core 0.23.35 and 1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.