# CVE-2026-69205: Http4s Ember HTTP request smuggling via Transfer-Encoding parsing

Source: https://junglewise.ai/threats/cve-2026-69205-http4s-ember-http-request-smuggling-via-transfer-encoding-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69205 · Severity: high · CVSS 8.7 · Published 2026-09-15

Http4s Ember is a Scala HTTP server and client library used in applications to handle HTTP/1.1 connections. The library's header parser fails to correctly interpret the Transfer-Encoding header according to RFC standards, allowing attackers to desynchronize request framing between Ember and upstream intermediaries (like proxies or load balancers). This enables HTTP request smuggling attacks that can bypass security controls, hijack other users' requests and credentials, or poison caches.

Technologies: [Http4s-Ember-Core](https://junglewise.ai/threats/technologies/http4s-ember-core), [org.http4s:http4s-ember-core_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-12), [org.http4s:http4s-ember-core_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-2-13), [org.http4s:http4s-ember-core_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-ember-core-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69205 being exploited in the wild.

**How severe is CVE-2026-69205?** High severity, with a CVSS score of 8.7, published 15 September 2026.

**Which products and versions are affected?** Http4s-Ember-Core ≤ 0.23.34; org.http4s:http4s-ember-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-ember-core_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

**Is there a fix for CVE-2026-69205?** Yes. org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69205 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69205?** Check whether you run Http4s-Ember-Core, org.http4s:http4s-ember-core_2.12 (Maven), org.http4s:http4s-ember-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-ember-core_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-core_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-ember-core_3 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-ember-core_3 to 0.23.35 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in Ember's HTTP/1.1 header parser, which uses a case-sensitive substring match (`hValue.contains("chunked")`) to detect chunked Transfer-Encoding. RFC 9112 §7 mandates case-insensitive comparison. Three parsing variants enable desync: (1) `Transfer-Encoding: Chunked` (capital C) is not recognized as chunked, causing Ember to fall back to Content-Length framing while compliant intermediaries use chunked framing; (2) `Transfer-Encoding: notchunked` triggers a false positive in the substring test; (3) UTF-8 decoding of header bytes can produce Unicode characters (e.g., U+212A KELVIN SIGN) that case-fold to ASCII letters, matching `chunked` unexpectedly. When Ember operates as an origin behind a keep-alive intermediary that respects RFC-compliant case-insensitive Transfer-Encoding handling, attackers can smuggle requests past the intermediary's ACL/auth, hijack subsequent victims' requests (exposing cookies/auth headers), or poison cached responses. Ember-client faces response smuggling risk when acting as a gateway to malicious upstreams. Patches are available in http4s-ember-core versions 0.23.35 and 1.0.0-M47.

## Affected products

- http4s http4s-ember-core_2.12 ≤ 0.23.34
- http4s http4s-ember-core_2.13 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46
- http4s http4s-ember-core_3 ≤ 0.23.34, 1.0.0-M1 to 1.0.0-M46

## Identifiers

- CVE-2026-69205
- GHSA-9998-894r-fwvr

## Timeline

- 2026-09-15: disclosed: Advisory published to GitHub Advisory Database
- 2026-09-15: patched: Fixes available in http4s-ember-core 0.23.35 and 1.0.0-M47

## References

- [https://api.github.com/users/ERobertGII](https://api.github.com/users/ERobertGII)
- [https://github.com/ERobertGII](https://github.com/ERobertGII)
- [https://api.github.com/users/ERobertGII/gists%7B/gist_id%7D](https://api.github.com/users/ERobertGII/gists%7B/gist_id%7D)
- [https://api.github.com/users/ERobertGII/repos](https://api.github.com/users/ERobertGII/repos)
- [https://avatars.githubusercontent.com/u/93225934?v=4](https://avatars.githubusercontent.com/u/93225934?v=4)
- [https://api.github.com/users/ERobertGII/events%7B/privacy%7D](https://api.github.com/users/ERobertGII/events%7B/privacy%7D)

## Related threats

- [Http4s Ember HTTP/2 frame buffering denial of service](https://junglewise.ai/threats/cve-2026-88975-http4s-ember-http-2-frame-buffering-denial-of-service)
- [Http4s Ember HTTP/2 unbounded continuation frame accumulation](https://junglewise.ai/threats/cve-2026-69218-http4s-ember-http-2-unbounded-continuation-frame-accumulation)
- [Http4s DigestAuth replay attack in authorization header](https://junglewise.ai/threats/cve-2026-69206-http4s-digestauth-replay-attack-in-authorization-header)
- [Http4s Ember HTTP/2 stream limit enforcement bypass](https://junglewise.ai/threats/cve-2026-69203-http4s-ember-http-2-stream-limit-enforcement-bypass)
- [Http4s Ember HTTP/2 unbounded inbound body buffering](https://junglewise.ai/threats/cve-2026-69202-http4s-ember-http-2-unbounded-inbound-body-buffering)