Skip to content
Threat Feed
Subscribe

Product

Http4s-Ember-Core (<= 0.23.34, >= 1.0.0-M1 and <= 1.0.0-M46)

1 brief RSS
critical advisory

HTTP Request Smuggling Vulnerability in http4s Ember

The http4s Ember HTTP/1.1 parser fails to reject messages containing both 'Transfer-Encoding' and 'Content-Length' headers, enabling CL.TE request smuggling attacks.

http4s-ember-core +5 request-smuggling cve-2026-69204 http-vulnerability denial-of-service vulnerability http2 http4s cve-2026-69202
3t 1c