Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.http4s:http4s-ember-core_3 | maven | <= 0.23.34 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13 | maven | <= 0.23.34 | 0.23.35 |
| org.http4s:http4s-ember-core_2.12 | maven | <= 0.23.34 | 0.23.35 |
| org.http4s:http4s-ember-core_2.13 | maven | >= 1.0.0-M1, <= 1.0.0-M46 | 1.0.0-M47 |
| org.http4s:http4s-ember-core_3 | maven | >= 1.0.0-M1, <= 1.0.0-M46 | 1.0.0-M47 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incorrect parsing of the Transfer-Encoding header in Http4s Ember. Specifically, the org.http4s.ember.core.Parser.HeaderP.parse function was identified as the vulnerable component. This function failed to adhere to RFC 9112 §7, which requires case-insensitive comparison for transfer-coding names. The original implementation used a case-sensitive contains("chunked") check, allowing an attacker to craft a Transfer-Encoding header (e.g., Transfer-Encoding: Chunked) that would be ignored by Ember but honored by a compliant intermediary. This discrepancy in interpretation of the request body's end enables HTTP request smuggling (TE.CL / TE.0).
Furthermore, the function was vulnerable to character encoding issues. It decoded header bytes using the platform's default charset instead of the required ISO-8859-1 (RFC 9110 §5.5). This could lead to multi-byte sequences being incorrectly interpreted, potentially allowing further bypasses of security checks through Unicode case-folding. The patch addresses both issues by implementing a robust case-insensitive check for 'chunked' and explicitly specifying StandardCharsets.ISO_8859_1 for header decoding. Exploitation would involve sending specially crafted Transfer-Encoding headers to an Ember server behind a compliant intermediary, leading to security bypasses, cross-user request hijacking, or cache poisoning.
org.http4s.ember.core.Parser.HeaderP.parseember-core/shared/src/main/scala/org/http4s/ember/core/Parser.scala