http4s-ember-core Maven Package Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- http4s-ember-core_2.12 (maven)
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the http4s-ember-core Maven package that may enable HTTP request smuggling. Users of this package are advised to assess their exposure and prepare for potential mitigation steps.
What happened
An early warning has been issued regarding a vulnerability in the http4s-ember-core Maven package. The package reportedly does not reject HTTP/1.1 requests that carry both Transfer-Encoding and Content-Length headers. This behavior may enable HTTP request smuggling, which can lead to security bypass, request hijacking, and cache poisoning. The vulnerability is under investigation and no authoritative version range has been published yet.
The affected components include http4s-ember-core_2.12, http4s-ember-core_2.13, and http4s-ember-core_3. Users of these components should review their dependencies and assess their exposure to this vulnerability. The primary source indicates that versions up to 0.23.34 are affected, with a patched version 0.23.35 available.
What to do about it
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- If using affected versions of http4s-ember-core, upgrade to version 0.23.35 or apply recommended workarounds.
- Review your application's HTTP request handling to ensure it is not vulnerable to request smuggling.
- Implement additional security measures to detect and prevent HTTP request smuggling attempts.
How 0Day would have caught this
http4s-ember-core_2.12 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using http4s-ember-core_2.12, http4s-ember-core_2.13, or http4s-ember-core_3 in your project, you may be affected. Check your dependencies against the affected versions.
What should I do right now?
Monitor the primary sources for updates and prepare to upgrade to the patched version 0.23.35 or apply recommended workarounds as soon as they are available.
Is there an official fix available?
Yes, version 0.23.35 of http4s-ember-core is reported to be patched. Upgrade to this version if you are using an affected version.