CVE-2026-69204: Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Ember’s HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC’s CL-strip-and-forward path (or that prioritises Content-Length) will frame the body differently from Ember, enabling HTTP request smuggling (CL.TE).