This vulnerability lies in the way Http4s Ember’s HeaderP.parse validates and decodes the Transfer‑Encoding header. The parser uses a case‑sensitive substring test and the platform default charset, which allows crafted values such as "notchunked" to be accepted or properly cased values to be misinterpreted. Attackers can exploit these parsing inconsistencies to induce TE.CL or TE.0 request smuggling, leading to access‑control bypass, cross‑user request hijacking, and cache poisoning on the server path. The effect is that an attacker can send unintended requests or manipulate server state without authorization. This reflects a weakness classified as CWE-444, related to insecure header parsing.

Any application using http4s before version 0.23.35 or before 1.0.0‑M47 is vulnerable. The fix is available in releases 0.23.35 and 1.0.0‑M47 and later.

The CVSS score of 8.7 indicates high severity, and the EPSS score is < 1%, indicating a low probability of exploitation, but the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the vulnerability via normal HTTP traffic to servers built with http4s, without prior authentication. The potential for significant impact and the lack of obvious mitigation make the risk high.