CVE-2026-69205

The Ember HTTP/1.x header parser in the Scala toolkit http4s tests the Transfer-Encoding header value with a case-sensitive substring match for 'chunked', violating RFC 9112 §7's requirement for case-insensitive comparison. An unauthenticated remote attacker who sends 'Transfer-Encoding: Chunked' (or values like 'notchunked' or a Kelvin-sign variant) causes Ember and an RFC-compliant front-end proxy to disagree on where the request body ends, enabling classic TE.CL / TE.0 request smuggling. Successful exploitation lets the attacker bypass front-end ACLs and authentication, hijack the next victim's request on a pooled keep-alive connection to capture its Cookie/Authorization headers, or poison cache entries; ember-client shares the same parser and enables response smuggling when http4s acts as a gateway to a malicious upstream. Any deployment running ember-server as an origin behind a proxy that treats Transfer-Encoding case-insensitively and forwards it verbatim is affected. No public proof of concept is known and there is no evidence of in-the-wild exploitation, though the issue carries a high CVSS 3.1 score of 8.7.

What to do: Upgrade http4s ember-server and ember-client to the first release that performs a case-insensitive, charset-pinned (ISO-8859-1) Transfer-Encoding token comparison, checking the http4s security advisories for the exact fixed versions once published. Where an immediate upgrade is not possible, mitigate at the intermediary: enable full request buffering and re-encoding (e.g. nginx's default proxy_request_buffering on), normalize or lowercase the Transfer-Encoding token before forwarding, or disable keep-alive between the proxy and the Ember backend. Audit gateway-style deployments using ember-client for signs of response-splitting from untrusted upstreams.