{"id":"CVE-2026-69216","aliases":["GHSA-jrpm-956j-96jg"],"url":"https://o3.security/vulnerability/CVE-2026-69216","summary":"Http4s: Ember chunk parser lenience (TE.TE request smuggling)","details":"## Summary\n\nEmber's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading `+` or `-` sign.  RFC9112 §7.1 defines `chunk-size = 1*HEXDIG`.  An intermediary that parses the chunk boundary differently (or rejects it) will disagree with Ember on request framing, enabling HTTP request smuggling (TE.TE).\n\n## Impact\n\n### Server\n\nRequest smuggling (TE.TE) when ember-server is an origin behind an intermediary that forwards the body verbatim but interprets the malformed chunk sizes differently\n\n- Front-end security bypass: the smuggled request reaches paths the intermediary might have blocked, with attacker-chosen method and headers.\n- Cache poisoning: the smuggled response is associated with the next request key in a caching proxy.\n- Request queue hijack:\n\n### Client\n\nember-client has the same leniencies on the response path, which enables response smuggling when http4s is used as a gateway.  This is less severe, as it requires a malicious or compromised upstream rather than an anonymous remote client.\n\n## Preconditions\n\n- Unauthenticated remote attacker (server)\n- ember-server as origin behind a keep-alive intermediary\n- Malicious or compromised upstream (client)\n- Intermediary or upstream forwards chunked bodies without re-encoding and disagrees with Ember on `+` prefix, `-` prefix, or leading and trailing octets rather than rejecting.\n\n## Workarounds\n\n- Intermediary strictly rejects malformed chunk sizes\n- Intermediary buffers and re-encodes request bodies\n\n## References\n\n- [RFC9112 §7.1: Chunked Transfer Coding](https://www.rfc-editor.org/rfc/rfc9112.html#name-chunked-transfer-coding)","published":"2026-09-15T18:59:50.609Z","modified":"2026-10-28T02:30:25.296833946Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"},"epss":{"score":0.00242,"percentile":0.1555,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.http4s:http4s-ember-core_2.12","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-core_2.13","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-core_3","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-core_2.13","fixedVersion":"1.0.0-M47"},{"ecosystem":"Maven","name":"org.http4s:http4s-ember-core_3","fixedVersion":"1.0.0-M47"}],"fix":{"url":"https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0","label":"http4s/http4s@d78612a"},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v0.23.35"},{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69216.json"},{"type":"ADVISORY","url":"https://github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69216"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:25.296833946Z"}}