CVE-2026-69217

http4s, the Scala HTTP toolkit, ships an HTTP/1.1 parser in its Ember backend that accepts requests containing multiple, conflicting Content-Length headers and uses the last value instead of rejecting the message. When an Ember-based server sits behind a keep-alive intermediary (such as a reverse proxy, load balancer, or CDN) that interprets a different Content-Length occurrence, an unauthenticated attacker can perform CL.CL request smuggling. Successful smuggling can bypass front-end access controls, capture headers (including credentials or cookies) of a subsequent user sharing the connection, or poison caches; the shared client parser can likewise misframe responses from a malicious or compromised upstream when the client proxies for multiple downstream consumers. All Ember servers and clients on versions prior to 0.23.35 and prior to 1.0.0-M47 are affected, with fixes available in 0.23.35 and 1.0.0-M47. There is no evidence of in-the-wild exploitation and no public proof of concept, though the flaw is trivially describable and requires no authentication to attempt.

What to do: Upgrade to http4s 0.23.35 (0.23.x line) or 1.0.0-M47 (milestone line) as soon as possible. Until patched, configure your front-end proxy or load balancer to reject (not normalize) requests containing multiple differing Content-Length headers, and review access logs for malformed framing that could indicate smuggling attempts. Audit any Ember-based services deployed behind keep-alive intermediaries and any services using the Ember client to proxy traffic for downstream consumers, since both server-side and client-side misframing apply.