https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 16:19:03 +0000 https://vulnerability.circl.lu/sighting/f7a887c3-dccf-4ede-b9ee-3dce3d3a0e00/export {"uuid": "f7a887c3-dccf-4ede-b9ee-3dce3d3a0e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69216", "type": "seen", "source": "https://gist.github.com/alon710/6236e1774119e3087877ec4be7fad5a0", "content": "# CVE-2026-69216: CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69216\n\n## Summary\nAn HTTP Request/Response Smuggling vulnerability (CVE-2026-69216) was identified in the Ember chunked transfer encoding decoder of the http4s Scala library. Due to parser leniency accepting sign prefixes, surrounding whitespace, and missing trailing CRLFs, attackers can bypass proxy security boundaries, poison shared caches, or hijack request queues.\n\n## TL;DR\nA lenient HTTP chunk decoder in the http4s Ember server allows TE.TE request and response smuggling attacks when combined with strict upstream reverse proxies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: Not yet calculated\n- **Impact**: Request/Response Smuggling, Cache Poisoning, Bypass of Proxy Controls\n- **Exploit Status**: None/PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s Ember Core\n- http4s Ember Server\n- http4s Ember Client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade the http4s dependencies to version 0.23.35 or 1.0.0-M47.\n- Configure front-end proxies to normalize or re-encode chunked HTTP requests.\n- Deploy HTTP/2 or HTTP/3 to avoid text-based HTTP/1.1 framing issues.\n\n**Remediation Steps:**\n1. Open your sbt build definition file (build.sbt).\n2. Identify references to org.http4s dependencies, specifically http4s-ember-server or http4s-ember-client.\n3. Update the version string to \"0.23.35\" or \"1.0.0-M47\" depending on your current major version branch.\n4. Reload the project configuration and rebuild the binary artifact to ensure the updated library is packaged.\n5. Redeploy the application and verify logs for potential ChunkedEncodingError exceptions indicating rejected malformed requests.\n\n## References\n\n- [GHSA-jrpm-956j-96jg: http4s-ember-core Request Smuggling](https://github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg)\n- [Ember core fix commit d78612a5](https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0)\n- [NVD - CVE-2026-69216](https://nvd.nist.gov/vuln/detail/CVE-2026-69216)\n- [http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69216) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T10:31:48.300472Z"} {"uuid": "f7a887c3-dccf-4ede-b9ee-3dce3d3a0e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69216", "type": "seen", "source": "https://gist.github.com/alon710/6236e1774119e3087877ec4be7fad5a0", "content": "# CVE-2026-69216: CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69216\n\n## Summary\nAn HTTP Request/Response Smuggling vulnerability (CVE-2026-69216) was identified in the Ember chunked transfer encoding decoder of the http4s Scala library. Due to parser leniency accepting sign prefixes, surrounding whitespace, and missing trailing CRLFs, attackers can bypass proxy security boundaries, poison shared caches, or hijack request queues.\n\n## TL;DR\nA lenient HTTP chunk decoder in the http4s Ember server allows TE.TE request and response smuggling attacks when combined with strict upstream reverse proxies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: Not yet calculated\n- **Impact**: Request/Response Smuggling, Cache Poisoning, Bypass of Proxy Controls\n- **Exploit Status**: None/PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s Ember Core\n- http4s Ember Server\n- http4s Ember Client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade the http4s dependencies to version 0.23.35 or 1.0.0-M47.\n- Configure front-end proxies to normalize or re-encode chunked HTTP requests.\n- Deploy HTTP/2 or HTTP/3 to avoid text-based HTTP/1.1 framing issues.\n\n**Remediation Steps:**\n1. Open your sbt build definition file (build.sbt).\n2. Identify references to org.http4s dependencies, specifically http4s-ember-server or http4s-ember-client.\n3. Update the version string to \"0.23.35\" or \"1.0.0-M47\" depending on your current major version branch.\n4. Reload the project configuration and rebuild the binary artifact to ensure the updated library is packaged.\n5. Redeploy the application and verify logs for potential ChunkedEncodingError exceptions indicating rejected malformed requests.\n\n## References\n\n- [GHSA-jrpm-956j-96jg: http4s-ember-core Request Smuggling](https://github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg)\n- [Ember core fix commit d78612a5](https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0)\n- [NVD - CVE-2026-69216](https://nvd.nist.gov/vuln/detail/CVE-2026-69216)\n- [http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69216) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T10:31:48.300472Z"} https://vulnerability.circl.lu/sighting/f7a887c3-dccf-4ede-b9ee-3dce3d3a0e00/export Wed, 16 Sep 2026 10:31:48 +0000