THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-9998-894r-fwvr (high) — Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

[GHSA] GHSA-9998-894r-fwvr (high) — Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

medgithub_advisoriesPublished 2026-09-15

GHSA-9998-894r-fwvr Severity: high CVE: CVE-2026-69205

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

## Summary

Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring test (`hValue.contains("chunked")`). RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying `Transfer-E

Indicators of compromise

Original source: https://github.com/advisories/GHSA-9998-894r-fwvr