CVE-2026-69205High· 8.7▾ TwilightHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.http4s:http4s-ember-core_3 <= 0.23.34org.http4s:http4s-ember-core_2.13 <= 0.23.34org.http4s:http4s-ember-core_2.12 <= 0.23.34org.http4s:http4s-ember-core_2.13 >= 1.0.0-M1, <= 1.0.0-M46org.http4s:http4s-ember-core_3 >= 1.0.0-M1, <= 1.0.0-M46Patched in:
org.http4s:http4s-ember-core_3 0.23.35org.http4s:http4s-ember-core_2.13 0.23.35org.http4s:http4s-ember-core_2.12 0.23.35org.http4s:http4s-ember-core_2.13 1.0.0-M47org.http4s:http4s-ember-core_3 1.0.0-M47Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69216Medium· 5.4Http4s is a Scala interface for HTTP services
CVE-2026-69204Critical· 9.2Http4s is a Scala interface for HTTP services
CVE-2026-69217High· 8.7Http4s is a Scala interface for HTTP services
CVE-2026-69215Medium· 6.8Http4s is a Scala interface for HTTP services
CVE-2026-69218High· 7.5Http4s is a Scala interface for HTTP services
CVE-2026-69206Medium· 5.9Http4s is a Scala interface for HTTP services