CVE-2026-69204Critical· 9.2▾ MidnightHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing r…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.http4s:http4s-ember-core_2.12 <= 0.23.34org.http4s:http4s-ember-core_2.13 <= 0.23.34org.http4s:http4s-ember-core_3 <= 0.23.34org.http4s:http4s-ember-core_2.13 >= 1.0.0-M1, <= 1.0.0-M46org.http4s:http4s-ember-core_3 >= 1.0.0-M1, <= 1.0.0-M46Patched in:
org.http4s:http4s-ember-core_2.12 0.23.35org.http4s:http4s-ember-core_2.13 0.23.35org.http4s:http4s-ember-core_3 0.23.35org.http4s:http4s-ember-core_2.13 1.0.0-M47org.http4s:http4s-ember-core_3 1.0.0-M47Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69216Medium· 5.4Http4s is a Scala interface for HTTP services
CVE-2026-69217High· 8.7Http4s is a Scala interface for HTTP services
CVE-2026-69218High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69206Medium· 5.9Http4s is a Scala interface for HTTP services
CVE-2026-69205High· 8.7Http4s is a Scala interface for HTTP services
CVE-2026-69214Medium· 6.8Http4s is a Scala interface for HTTP services