CVE-2026-69217: Http4s Ember HTTP/1.1 parser request smuggling via duplicate Content-Length

CVE-2026-69217 · Severity: high · CVSS 8.7 · Published 2026-09-15

Http4s is a Scala library providing HTTP server and client functionality. Ember's HTTP/1.1 parser accepted duplicate Content-Length headers with different values, using the last one instead of rejecting the message. When deployed behind a proxy that selects a different occurrence, attackers could perform request smuggling to bypass authentication controls, capture other users' request headers, or poison shared caches. The same flaw affected the shared client parser when acting as a proxy for multiple downstream consumers.

Technologies: Http4s. Vendors: Http4s.

Quick answers

Is CVE-2026-69217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69217 being exploited in the wild.
How severe is CVE-2026-69217?
High severity, with a CVSS score of 8.7, published 15 September 2026.
Which products and versions are affected?
Http4s prior to 0.23.35 and 1.0.0-M47.
Is there a fix for CVE-2026-69217?
A patch was published on 2026-07-06: Version 0.23.35 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69217 attacked?
It is attacked over the network.
Am I affected by CVE-2026-69217?
Check whether you run Http4s at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a request smuggling flaw (CL.CL variant) in the HTTP/1.1 parser component of Http4s Ember. The root cause is that the parser accepted multiple Content-Length headers and used the final value instead of rejecting the message as non-compliant with RFC 9110 §8.6, which mandates Content-Length = 1*DIGIT with no duplicates. Additionally, the parser accepted negative values via `String.toLong` (which allows a leading sign), treating negative lengths as zero in `parseFixedBody`, leaving remaining bytes to be interpreted as a second request on the keep-alive connection. The attack requires network reachability to an Ember server behind a proxy with divergent Content-Length parsing behavior. No authentication is required. Attackers can craft requests that smuggle payloads past front-end controls, capture subsequent legitimate user requests, or poison caches. The fix validates Content-Length as ASCII digits only, rejects conflicting duplicate values, and treats overflow as an invalid message.

Affected products

  • Http4s Http4s prior to 0.23.35 and 1.0.0-M47

Timeline

  • 2026-09-15: disclosed
  • 2026-07-06: patched: Version 0.23.35 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.