GHSA-8h4c-x2wg-6xp8

Suggest an improvement
Source
https://github.com/advisories/GHSA-8h4c-x2wg-6xp8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8h4c-x2wg-6xp8
Aliases
Published
2026-09-15T19:53:44Z
Modified
2026-09-15T20:00:39Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
Details

Summary

Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 ยง6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward path (or that prioritises Content-Length) will frame the body differently from Ember, enabling HTTP request smuggling (CL.TE).

Impact

Server

Request smuggling when ember-server is an origin behind an intermediary that forwards both headers over a keep-alive backend connection and frames by Content-Length while Ember frames by chunked:

  • Front-end security bypass: the smuggled request reaches paths the intermediary's ACL/auth layer would have blocked, with attacker-chosen method and headers.
  • Cross-user request hijack: a dangling smuggled prefix concatenates with the next victim's request on the shared backend socket, capturing its headers.
  • Cache poisoning: the smuggled response is associated with the next request key in a caching proxy.

Client

ember-client shares the same parser on the response path. An upstream that sends both headers can desync a pooled client connection. This requires a malicious or compromised upstream.

Preconditions

  • Unauthenticated remote attacker (server)
  • ember-server as origin behind a keep-alive intermediary
  • Intermediary forwards a request carrying both Transfer-Encoding and Content-Length (RFC says it MAY reject; many forward) and frames by Content-Length
  • Malicious or compromised upstream (client)

Workarounds

  • Intermediary strictly rejects requests carrying both Transfer-Encoding and Content-Length
  • Intermediary buffers and re-encodes request bodies
  • Disable backend keep-alive between the intermediary and Ember
Database specific 
{
    "cwe_ids": [
        "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-15T19:53:44Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}
References

Affected packages

Maven
org.http4s:http4s-ember-core_2.12

Package

Name
org.http4s:http4s-ember-core_2.12
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-ember-core_2.12

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.10.0-M10
0.21.0-M2
0.21.0-M3
0.21.0-M4
0.21.0-M5
0.21.0-M6
0.21.0-RC1
0.21.0-RC2
0.21.0-RC3
0.21.0-RC4
0.21.0-RC5
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.21.11
0.21.12
0.21.13
0.21.14
0.21.15
0.21.16
0.21.17
0.21.18
0.21.19
0.21.20
0.21.21
0.21.22
0.21.23
0.21.24
0.21.25
0.21.26
0.21.27
0.21.28
0.21.29
0.21.30
0.21.31
0.21.32
0.21.33
0.21.34
0.22.0-M1
0.22.0-M2
0.22.0-M3
0.22.0-M4
0.22.0-M5
0.22.0-M6
0.22.0-M7
0.22.0-M8
0.22.0-RC1
0.22.0
0.22-53-01128f5
0.22-96-55d3184
0.22-129-24d065b
0.22-143-49b5a8d
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json"
org.http4s:http4s-ember-core_2.13

Package

Name
org.http4s:http4s-ember-core_2.13
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-ember-core_2.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.10.0-M10
0.21.0-M2
0.21.0-M3
0.21.0-M4
0.21.0-M5
0.21.0-M6
0.21.0-RC1
0.21.0-RC2
0.21.0-RC3
0.21.0-RC4
0.21.0-RC5
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.21.11
0.21.12
0.21.13
0.21.14
0.21.15
0.21.16
0.21.17
0.21.18
0.21.19
0.21.20
0.21.21
0.21.22
0.21.23
0.21.24
0.21.25
0.21.26
0.21.27
0.21.28
0.21.29
0.21.30
0.21.31
0.21.32
0.21.33
0.21.34
0.22.0-M1
0.22.0-M2
0.22.0-M3
0.22.0-M4
0.22.0-M5
0.22.0-M6
0.22.0-M7
0.22.0-M8
0.22.0-RC1
0.22.0
0.22-53-01128f5
0.22-96-55d3184
0.22-129-24d065b
0.22-143-49b5a8d
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json"
org.http4s:http4s-ember-core_3

Package

Name
org.http4s:http4s-ember-core_3
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-ember-core_3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.22.0-M8
0.22.0-RC1
0.22.0
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json"
org.http4s:http4s-ember-core_2.13

Package

Name
org.http4s:http4s-ember-core_2.13
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-ember-core_2.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0-M1
Fixed
1.0.0-M47

Affected versions

1.*
1.0.0-M2
1.0.0-M3
1.0.0-M4
1.0.0-M5
1.0.0-M6
1.0.0-M7
1.0.0-M8
1.0.0-M9
1.0.0-M10
1.0.0-M11
1.0.0-M13
1.0.0-M14
1.0.0-M15
1.0.0-M16
1.0.0-M17
1.0.0-M18
1.0.0-M19
1.0.0-M20
1.0.0-M21
1.0.0-M22
1.0.0-M23
1.0.0-M24
1.0.0-M25
1.0.0-M27
1.0.0-M28
1.0.0-M29
1.0.0-M30
1.0.0-M31
1.0.0-M32
1.0.0-M33
1.0.0-M34
1.0.0-M35
1.0.0-M36
1.0.0-M37
1.0.0-M38
1.0.0-M39
1.0.0-M40
1.0.0-M41
1.0.0-M42
1.0.0-M43
1.0.0-M44
1.0.0-M45
1.0.0-M46

Database specific

last_known_affected_version_range 
"<= 1.0.0-M46"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json"
org.http4s:http4s-ember-core_3

Package

Name
org.http4s:http4s-ember-core_3
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-ember-core_3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0-M1
Fixed
1.0.0-M47

Affected versions

1.*
1.0.0-M22
1.0.0-M23
1.0.0-M24
1.0.0-M25
1.0.0-M27
1.0.0-M28
1.0.0-M29
1.0.0-M30
1.0.0-M31
1.0.0-M32
1.0.0-M33
1.0.0-M34
1.0.0-M35
1.0.0-M36
1.0.0-M37
1.0.0-M38
1.0.0-M39
1.0.0-M40
1.0.0-M41
1.0.0-M42
1.0.0-M43
1.0.0-M44
1.0.0-M45
1.0.0-M46

Database specific

last_known_affected_version_range 
"<= 1.0.0-M46"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8h4c-x2wg-6xp8/GHSA-8h4c-x2wg-6xp8.json"