CyberRota Analysis
AI-GeneratedEmber's HeaderP.parse in Http4s versions prior to 0.23.35 and 1.0.0-M47 is vulnerable due to a case-sensitive substring test for the Transfer-Encoding value, leading to potential request smuggling, access-control bypass, and cache poisoning. This vulnerability can be exploited by intermediaries that do not adhere to RFC-compliant token and charset rules, allowing attackers to manipulate Content-Length and framing. Organizations using affected versions of Http4s should prioritize upgrading to the patched versions to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.