CVE-2026-69216: Http4s: Ember chunk parser lenience (TE.TE request smuggling)
Ember’s chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1*HEXDIG. An intermediary that parses the chunk boundary differently (or rejects it) will disagree with Ember on request framing, enabling HTTP request smuggling (TE.TE).
References
- github.com/advisories/GHSA-jrpm-956j-96jg
- github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg
- nvd.nist.gov/vuln/detail/CVE-2026-69216
Code Behaviors & Features
Detect and mitigate CVE-2026-69216 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →