{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/http4s-ember-core-1.0.0-m1---1.0.0-m46/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:http4s:http4s_ember_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-69204"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["http4s-ember-core (\u003c= 0.23.34)","http4s-ember-core (1.0.0-M1 - 1.0.0-M46)","http4s-ember-core (\u003c= 0.23.36)","http4s-ember-core (1.0.0-M1 - 1.0.0-M47)","http4s-ember-core (\u003c= 0.23.34, \u003e= 1.0.0-M1 and \u003c= 1.0.0-M46)","http4s-ember-core (\u003e= 1.0.0-M1, \u003c= 1.0.0-M46)"],"_cs_severities":["critical"],"_cs_tags":["request-smuggling","cve-2026-69204","http-vulnerability","denial-of-service","vulnerability","http2","http4s","cve-2026-69202"],"_cs_type":"advisory","_cs_vendors":["http4s"],"content_html":"\u003cp\u003eThe http4s Ember HTTP/1.1 parser (CVE-2026-69204) fails to comply with RFC 9112 §6.1, which mandates that servers treat any HTTP/1.1 message containing both 'Transfer-Encoding' and 'Content-Length' headers as a framing error and close the connection. Because Ember accepts both, discrepancies arise when it is deployed behind an intermediary that frames the request based on 'Content-Length' while Ember frames based on 'Transfer-Encoding' (chunked). This desynchronization creates a CL.TE request smuggling condition. Attackers can exploit this to perform request smuggling, bypassing authentication filters, performing cross-user request hijacking, or poisoning backend caches. The vulnerability affects both 'ember-server' (origin) and 'ember-client' (response processing), with the latter vulnerable to desynchronization from a malicious upstream source.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP/1.1 request containing both 'Transfer-Encoding: chunked' and a 'Content-Length' header.\u003c/li\u003e\n\u003cli\u003eAttacker sends the request to the intermediary load balancer or reverse proxy sitting in front of the target Ember server.\u003c/li\u003e\n\u003cli\u003eThe intermediary processes the 'Content-Length' header, framing the request body accordingly, and forwards the entire packet to the backend Ember server.\u003c/li\u003e\n\u003cli\u003eThe backend Ember server, ignoring the 'Content-Length' header in favor of 'Transfer-Encoding', parses the request as chunked.\u003c/li\u003e\n\u003cli\u003eThe Ember server interprets only the first chunk of the request, leaving the remainder of the payload in the socket buffer.\u003c/li\u003e\n\u003cli\u003eThe residual data in the socket buffer is interpreted by the Ember server as the prefix of the next legitimate user request sent over the same keep-alive connection.\u003c/li\u003e\n\u003cli\u003eEmber processes the smuggled data as a separate request, achieving unauthorized execution or security bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for critical security impacts, including the bypassing of front-end security policies, unauthorized cross-user request hijacking, and HTTP cache poisoning. These impacts are most severe in architectures where Ember handles keep-alive backend connections from an intermediary that does not strictly sanitize request headers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade http4s-ember-core to a non-vulnerable version as soon as patches become available to address CVE-2026-69204.\u003c/li\u003e\n\u003cli\u003eConfigure upstream intermediaries to strictly reject HTTP/1.1 requests containing both 'Transfer-Encoding' and 'Content-Length' headers.\u003c/li\u003e\n\u003cli\u003eEnsure intermediaries buffer and re-encode request bodies to normalize framing before sending them to the backend server.\u003c/li\u003e\n\u003cli\u003eDisable keep-alive connections between the intermediary and the Ember backend if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to detect and drop HTTP requests containing duplicate or conflicting framing headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T01:06:08Z","date_published":"2026-09-16T01:05:04Z","id":"https://feed.craftedsignal.io/briefs/2026-09-http4s-ember-smuggling/","summary":"The http4s Ember HTTP/1.1 parser fails to reject messages containing both 'Transfer-Encoding' and 'Content-Length' headers, enabling CL.TE request smuggling attacks.","title":"HTTP Request Smuggling Vulnerability in http4s Ember","url":"https://feed.craftedsignal.io/briefs/2026-09-http4s-ember-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Http4s-Ember-Core (1.0.0-M1 - 1.0.0-M46)","version":"https://jsonfeed.org/version/1.1"}