---
id: CVE-2026-69204
title: Http4s is a Scala interface for HTTP services
summary: >-
  Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47,
  Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and
  Content-Length, so an intermediary and Ember can select different body framing
  r…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-444
vendor: http4s
product: http4s
affected:
  - http4s < 0.23.35
  - 'http4s >= 1.0.0-M1, < 1.0.0-M47'
patched:
  - 'org.http4s:http4s-ember-core_2.12 0.23.35'
  - 'org.http4s:http4s-ember-core_2.13 0.23.35'
  - 'org.http4s:http4s-ember-core_3 0.23.35'
  - 'org.http4s:http4s-ember-core_2.13 1.0.0-M47'
  - 'org.http4s:http4s-ember-core_3 1.0.0-M47'
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:39:16.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69204'
references:
  - url: >-
      https://github.com/http4s/http4s/commit/9feaf8677951a52af906ae9664ff6f0543d9d810
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v0.23.35'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/releases/tag/v1.0.0-M47'
    label: security-advisories@github.com
  - url: 'https://github.com/http4s/http4s/security/advisories/GHSA-8h4c-x2wg-6xp8'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8h4c-x2wg-6xp8'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
aliases:
  - GHSA-8h4c-x2wg-6xp8
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T19:00:36.832324Z'
cvssSource: cna
ingestedAt: '2026-09-15T19:42:58.803Z'
epss: 0.00331
epssPercentile: 0.26459
---

## Overview

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69204)

Affected packages:

- `org.http4s:http4s-ember-core_2.12 <= 0.23.34`
- `org.http4s:http4s-ember-core_2.13 <= 0.23.34`
- `org.http4s:http4s-ember-core_3 <= 0.23.34`
- `org.http4s:http4s-ember-core_2.13 >= 1.0.0-M1, <= 1.0.0-M46`
- `org.http4s:http4s-ember-core_3 >= 1.0.0-M1, <= 1.0.0-M46`

Patched in:

- `org.http4s:http4s-ember-core_2.12 0.23.35`
- `org.http4s:http4s-ember-core_2.13 0.23.35`
- `org.http4s:http4s-ember-core_3 0.23.35`
- `org.http4s:http4s-ember-core_2.13 1.0.0-M47`
- `org.http4s:http4s-ember-core_3 1.0.0-M47`

Source: https://github.com/advisories/GHSA-8h4c-x2wg-6xp8