This flaw represents a CWE-444 weakness. Http4s’ Ember chunk decoder accepted malformed chunk-size tokens, trimming leading or trailing characters and allowing an unauthenticated attacker to construct TE.TE request smuggling. The attacker can bypass intermediary controls, poison caches or hijack the request processing queue, and the same leniency also permits response smuggling when an ember-client gateway receives data from a malicious upstream.

The vulnerability affects the Http4s Scala HTTP library prior to release 0.23.35 and 1.0.0-M47. All projects using older versions of http4s are potentially impacted according to the CNA advisories.

The CVSS score of 5.4 indicates medium severity. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not currently listed in the KEV catalog. An attacker can trigger the flaw by sending a crafted HTTP request over the network to any intermediary that forwards chunked traffic unmodified, so the attack vector is network based and requires no authentication.