HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

GHSA-JRPM-956J-96JG Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69210

Http4s , a Scala HTTP service library, is vulnerable to a denial of service via its WebSocket decoder. In versions prior to 0.23.35 and 1.0.0-M47 , FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but incorrectly permits negative 64-bit lengths . A remote client...

CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69216

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

CVE-2026-69209

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

CVE-2026-58699

In Vp9DecEndOfStream of vp9hwdoutput.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56997

In Av1DecodeFrameTag of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56942

In ReadTileInfo of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56920

In sdecodevuiparam of fwhevcdecheader.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0170

In Vp9DecodeFrameTag of vp9hwdheaders.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69216 Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

EUVD-2026-79176

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

CVE-2026-69216 Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

CVE-2026-69209 Http4s: WebSocket decoder accepts unbounded message sizes

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

CVE-2026-69209

Http4s , a Scala library for HTTP services, contains an unbounded memory buffering flaw in its shared WebSocket decoder . Defragmentation accumulates fragments without a size limit, and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handsha...

CVE-2026-69209 Http4s: WebSocket decoder accepts unbounded message sizes

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that...

CVE-2026-58710

In DecodeFilmGrainParams of filmgraindec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...