TI-2026-48549 Aliases CVE-2026-69205 GHSA-9998-894r-fwvr

Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

MEDIUM 40CWE-444Published 2026-09-15 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0048 41st percentileScored 2026-11-07

Fix Fixed http4s (http4s): 0.23.35, 1.0.0-M47org.http4s:http4s-ember-core_3 (Maven): 0.23.35, 1.0.0-M47+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
http4s	http4s	before 0.23.35; 1.0.0-M1 to before 1.0.0-M47	0.23.35, 1.0.0-M47	Patch available	CNA
—	org.http4s:http4s-ember-core_3 (Maven)	before 0.23.35	0.23.35	Patch available	GHSA-9998-894r-fwvr
—	org.http4s:http4s-ember-core_2.13 (Maven)	before 0.23.35	0.23.35	Patch available	GHSA-9998-894r-fwvr
—	org.http4s:http4s-ember-core_2.12 (Maven)	before 0.23.35	0.23.35	Patch available	GHSA-9998-894r-fwvr
—	org.http4s:http4s-ember-core_2.13 (Maven)	1.0.0-M1 to before 1.0.0-M47	1.0.0-M47	Patch available	GHSA-9998-894r-fwvr
—	org.http4s:http4s-ember-core_3 (Maven)	1.0.0-M1 to before 1.0.0-M47	1.0.0-M47	Patch available	GHSA-9998-894r-fwvr

http4s Vendorhttp4s Affected before 0.23.35; 1.0.0-M1 to before 1.0.0-M47 Fixed in 0.23.35, 1.0.0-M47 Patch available CNA
org.http4s:http4s-ember-core_3 (Maven) Vendor— Affected before 0.23.35 Fixed in 0.23.35 Patch available GHSA-9998-894r-fwvr
org.http4s:http4s-ember-core_2.13 (Maven) Vendor— Affected before 0.23.35 Fixed in 0.23.35 Patch available GHSA-9998-894r-fwvr
org.http4s:http4s-ember-core_2.12 (Maven) Vendor— Affected before 0.23.35 Fixed in 0.23.35 Patch available GHSA-9998-894r-fwvr
org.http4s:http4s-ember-core_2.13 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M47 Fixed in 1.0.0-M47 Patch available GHSA-9998-894r-fwvr
org.http4s:http4s-ember-core_3 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M47 Fixed in 1.0.0-M47 Patch available GHSA-9998-894r-fwvr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:typelevel:http4s::::::::	—	—	http4s

cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:* Versions — — ·http4s

Remediation

Fix · CNA http4s (http4s) Fixed in 0.23.35, 1.0.0-M47
Fix · GHSA-9998-894r-fwvr org.http4s:http4s-ember-core_3 (Maven) Fixed in 0.23.35 Advisory →
Fix · GHSA-9998-894r-fwvr org.http4s:http4s-ember-core_2.13 (Maven) Fixed in 0.23.35 Advisory →
Fix · GHSA-9998-894r-fwvr org.http4s:http4s-ember-core_2.12 (Maven) Fixed in 0.23.35 Advisory →
Fix · GHSA-9998-894r-fwvr org.http4s:http4s-ember-core_2.13 (Maven) Fixed in 1.0.0-M47 Advisory →
Fix · GHSA-9998-894r-fwvr org.http4s:http4s-ember-core_3 (Maven) Fixed in 1.0.0-M47 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-69205
2026-10-03 Alias added: GHSA-9998-894r-fwvr

References

Other 5

TI-2022-13223 mTLS client verification is skipped in fs2 on Node.js CVSS 3.1CRITICAL 9.8
TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
TI-2022-06031 Hash collision in typelevel jawn CVSS 3.1HIGH 7.5
TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
TI-2026-44185 http4s-scala-xml has an XML External Entity (XXE) processing issue CVSS 3.1CRITICAL 9.3
TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences