GHSA-JRPM-956J-96JG Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

Http4s Ember HTTP/2 has an unbounded outbound frame queue

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber writeLoop. When the write side stalls, any frames the connection keeps producing accumulate in that queue without limit. The peer can drive this cheaply because the connection emi...

GHSA-8F3Q-3JMV-7PRW Http4s Ember HTTP/2 has an unbounded outbound frame queue

Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber writeLoop. When the write side stalls, any frames the connection keeps producing accumulate in that queue without limit. The peer can drive this cheaply because the connection emi...

dev.i10416:slackapis-core_3 (>=0.0.1, <=0.0.2), es.weso:schema_3 (>=0.1.103, <=0.2.4) +22 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-m22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =0.1.0, =0.1.7 and more Source cves: CVE-2026-69206 Source advisory: GHSA-9XWW-74XV-GJFP...

ai.starlake:quack-on-demand_3 (>=0.1.0, <=0.4.0), com.47deg:energy-monitor-persistence-app_3 (0.2.0) +194 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_3 (>=0.22.0-m8, <=0.23.34)

org.http4s:http4s-ember-core3 MAVEN version =0.22.0-m8, =0.1.0, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =1.0.0, =0.0.0-3-cca5341b, =7.1.0, =7.1.1 and more Source cves: CVE-2026-69206 Source advisory: GHSA-9XWW-74XV-GJFP...

co.topl:bifrost-daml-broker_2.13 (1.0.0.beta-2), co.topl:brambl-cli_2.13 (>=2.0.0-beta1, <=2.0.0-beta6) +126 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_2.13 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.13 MAVEN version =0.10.0-m10, =2.0.0-beta1, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.1.0, =0.21.0, =0.24.0 and more Source cves: CVE-2026-69206 Source advisory: GHSA-9XWW-74XV-GJFP...

dev.i10416:slackapis-core_2.13 (>=0.0.1, <=0.0.2), es.weso:rdfshape-server_2.13 (>=0.0.73, <=0.2.14) +16 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_2.13 (>=1.0.0-m2, <=1.0.0-m46)

org.http4s:http4s-ember-core2.13 MAVEN version =1.0.0-m2, =0.0.1, =0.0.73, =0.1.90, =0.1.90, =0.1.90, =0.1.91, =0.1.109, =0.1.91, =0.1.101, =0.0.82, =0.1.91, =0.1.0, =2.1.0, =2.1.0, =2.2.2 and more Source cves: CVE-2026-69206 Source advisory: OSV:GHSA-9XWW-74XV-GJFP...

com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +69 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2026-69206 Source advisory: GHSA-9XWW-74XV-GJFP...

GHSA-9998-894R-FWVR Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

GHSA-8H4C-X2WG-6XP8 Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

GHSA-9VWC-PC8P-253Q Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

co.topl:bifrost-daml-broker_2.13 (1.0.0.beta-2), co.topl:brambl-cli_2.13 (>=2.0.0-beta1, <=2.0.0-beta6) +126 more potentially affected by CVE-2023-44487 +1 more via org.http4s:http4s-ember-core_2.13 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.13 MAVEN version =0.10.0-m10, =2.0.0-beta1, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.1.0, =0.21.0, =0.24.0 and more Source cves: CVE-2023-44487, CVE-2026-69203 Source advisory:...

com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +69 more potentially affected by CVE-2023-44487 +1 more via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2023-44487, CVE-2026-69203 Source advisory:...

dev.i10416:slackapis-core_2.13 (>=0.0.1, <=0.0.2), es.weso:rdfshape-server_2.13 (>=0.0.73, <=0.2.14) +16 more potentially affected by CVE-2023-44487 +1 more via org.http4s:http4s-ember-core_2.13 (>=1.0.0-m2, <=1.0.0-m46)

org.http4s:http4s-ember-core2.13 MAVEN version =1.0.0-m2, =0.0.1, =0.0.73, =0.1.90, =0.1.90, =0.1.90, =0.1.91, =0.1.109, =0.1.91, =0.1.101, =0.0.82, =0.1.91, =0.1.0, =2.1.0, =2.1.0, =2.2.2 and more Source cves: CVE-2023-44487, CVE-2026-69203 Source advisory: GHSA-9VWC-PC8P-253Q...

ai.starlake:quack-on-demand_3 (>=0.1.0, <=0.4.0), com.47deg:energy-monitor-persistence-app_3 (0.2.0) +194 more potentially affected by CVE-2023-44487 +1 more via org.http4s:http4s-ember-core_3 (>=0.22.0-m8, <=0.23.34)

org.http4s:http4s-ember-core3 MAVEN version =0.22.0-m8, =0.1.0, =0.0-a75a626, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.1, =1.0.0, =0.0.0-3-cca5341b, =7.1.0, =7.1.1 and more Source cves: CVE-2023-44487, CVE-2026-69203 Source advisory: GHSA-9VWC-PC8P-253Q...

dev.i10416:slackapis-core_3 (>=0.0.1, <=0.0.2), es.weso:schema_3 (>=0.1.103, <=0.2.4) +22 more potentially affected by CVE-2023-44487 +1 more via org.http4s:http4s-ember-core_3 (>=1.0.0-m22, <=1.0.0-m46)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-m22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =0.1.0, =0.1.7 and more Source cves: CVE-2023-44487, CVE-2026-69203 Source advisory: GHSA-9VWC-PC8P-253Q...