CyberRota Analysis
AI-GeneratedEmber HTTP/1.1 in Http4s versions prior to 0.23.35 and 1.0.0-M47 is vulnerable to request smuggling due to improper handling of both Transfer-Encoding and Content-Length headers, allowing unauthenticated attackers to bypass access controls and manipulate cached responses. This critical vulnerability can lead to serious security breaches, including cache poisoning and unauthorized request execution. Organizations using affected versions should prioritize immediate upgrades to the patched releases to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary that forwards both headers and frames by Content-Length, an unauthenticated attacker can smuggle a second request, bypass intermediary access controls, poison caches, or cause a victim request to be joined to an attacker-controlled prefix. The shared response parser can also desynchronize an ember-client connection when a malicious or compromised upstream sends both headers. This issue is fixed in versions 0.23.35 and 1.0.0-M47.