CVE-2026-69217

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47

Description Ember's HTTP/1.1 parser accepts duplicate Content-Length headers with different values and utilizes the last value instead of rejecting the message. This behavior allows an unauthenticated attacker to perform CL.CL request smuggling when the server is positioned behind a keep-alive intermediary that selects a different header occurrence. This can lead to the bypass of front-end controls, capture of subsequent user headers, or cache poisoning. Additionally, the shared client parser may misframe responses from a compromised or malicious upstream source when the client functions as a proxy for multiple downstream consumers.

Recommendations Update to version 0.23.35. Update to version 1.0.0-M47.