Executive brief
Http4s is a Scala library providing HTTP server and client functionality. Ember's HTTP/1.1 parser accepted duplicate Content-Length headers with different values, using the last one instead of rejecting the message. When deployed behind a proxy that selects a different occurrence, attackers could perform request smuggling to bypass authentication controls, capture other users' request headers, or poison shared caches. The same flaw affected the shared client parser when acting as a proxy for multiple downstream consumers.
Technical details
The vulnerability is a request smuggling flaw (CL.CL variant) in the HTTP/1.1 parser component of Http4s Ember. The root cause is that the parser accepted multiple Content-Length headers and used the final value instead of rejecting the message as non-compliant with RFC 9110 §8.6, which mandates Content-Length = 1*DIGIT with no duplicates. Additionally, the parser accepted negative values via `String.toLong` (which allows a leading sign), treating negative lengths as zero in `parseFixedBody`, leaving remaining bytes to be interpreted as a second request on the keep-alive connection. The attack requires network reachability to an Ember server behind a proxy with divergent Content-Length parsing behavior. No authentication is required. Attackers can craft requests that smuggle payloads past front-end controls, capture subsequent legitimate user requests, or poison caches. The fix validates Content-Length as ASCII digits only, rejects conflicting duplicate values, and treats overflow as an invalid message.
Affected products
- Http4s Http4s prior to 0.23.35 and 1.0.0-M47
Timeline
- 2026-09-15: disclosed
- 2026-07-06: patched: Version 0.23.35 released with fix