CVE-2026-69216: Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Ember’s chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1*HEXDIG. An intermediary that parses the chunk boundary differently (or rejects it) will disagree with Ember on request framing, enabling HTTP request smuggling (TE.TE).
References
- github.com/advisories/GHSA-jrpm-956j-96jg
- github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg
- nvd.nist.gov/vuln/detail/CVE-2026-69216
Code Behaviors & Features
Detect and mitigate CVE-2026-69216 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →