{"vulnerability": "CVE-2026-6921", "sightings": [{"uuid": "8600e9b3-d615-4ea3-95ce-3e6282957a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6921", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6qyal3zb2g", "content": "", "creation_timestamp": "2026-04-23T19:34:26.853640Z"}, {"uuid": "1e1f037f-772c-4fa2-99b4-1a088d7542d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6921", "type": "seen", "source": "Telegram/vObnyALXsyXLFJkccB0eoKwgfsCPRSJ_aAgpRRcRjZAUW0s", "content": "", "creation_timestamp": "2026-04-23T21:25:56.000000Z"}, {"uuid": "cf7d12a6-befa-4545-b024-f3acbdaca096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69212", "type": "seen", "source": "Telegram/qX6uclG6gRLHTMJxNJtazIs1OARckyerT1gitLQMuOtBOu0", "content": "", "creation_timestamp": "2026-07-16T19:00:28.286602Z"}, {"uuid": "2d43a1bd-9674-40e6-a18e-e5c0e3fc0cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69212", "type": "seen", "source": "Telegram/qX6uclG6gRLHTMJxNJtazIs1OARckyerT1gitLQMuOtBOu0", "content": "", "creation_timestamp": "2026-07-17T00:00:45.722673Z"}, {"uuid": "c241dca0-01cd-427e-9e2d-52813897a9e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69212", "type": "published-proof-of-concept", "source": "Telegram/qX6uclG6gRLHTMJxNJtazIs1OARckyerT1gitLQMuOtBOu0", "content": "", "creation_timestamp": "2026-07-18T02:00:06.136371Z"}, {"uuid": "62f0d5c3-5558-4f95-9563-f16682aa72c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69212", "type": "published-proof-of-concept", "source": "Telegram/qX6uclG6gRLHTMJxNJtazIs1OARckyerT1gitLQMuOtBOu0", "content": "", "creation_timestamp": "2026-07-19T00:00:40.880630Z"}, {"uuid": "eb3661ca-3978-41ba-a26f-86d34d488056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69213", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7l7nfi2e", "content": "\ud83d\udfe0 CVE-2026-69213 - High (7.5)\n\nHttp4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 seria...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69213/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T20:03:26.842056Z"}, {"uuid": "c997b6b8-e159-4544-8110-ba33faea72a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69218", "type": "seen", "source": "https://gist.github.com/alon710/1d7bf0359f0215ea04330c59b303d19c", "content": "# CVE-2026-69218: CVE-2026-69218: Denial of Service via Unbounded HTTP/2 Continuation Frame Buffering in http4s Ember\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69218\n\n## Summary\nA critical resource exhaustion vulnerability exists in the http4s Ember HTTP/2 server and client implementations. By failing to limit the size or quantity of incoming HTTP/2 CONTINUATION frames, the engine allows unauthenticated remote attackers to exhaust JVM heap memory, causing a complete Denial of Service.\n\n## TL;DR\nUnbounded HTTP/2 CONTINUATION frames cause JVM heap exhaustion and DoS in http4s Ember.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s-ember-server\n- http4s-ember-client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade http4s library dependencies to patched versions (0.23.35 or 1.0.0-M47)\n- Deploy a reverse proxy such as Nginx or Envoy in front of http4s to handle the HTTP/2 frame layer\n- Apply strict request rate-limiting and connection limits at the edge firewall\n\n**Remediation Steps:**\n1. Identify all projects and microservices using org.http4s:http4s-ember-server or org.http4s:http4s-ember-client.\n2. Update build definitions (e.g., build.sbt) to use version 0.23.35 or 1.0.0-M47.\n3. Validate the fix by verifying that incoming headers exceeding configured limits trigger HTTP/2 EnhanceYourCalm (0xb) errors.\n4. Re-deploy the updated service instances and monitor JVM memory performance metrics.\n\n## References\n\n- [GHSA-cp4q-fqw9-4hf6: http4s Vulnerability Advisory](https://github.com/http4s/http4s/security/advisories/GHSA-cp4q-fqw9-4hf6)\n- [CVE-2026-69218 Record](https://www.cve.org/CVERecord?id=CVE-2026-69218)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69218) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T09:31:31.539502Z"}, {"uuid": "f7a887c3-dccf-4ede-b9ee-3dce3d3a0e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69216", "type": "seen", "source": "https://gist.github.com/alon710/6236e1774119e3087877ec4be7fad5a0", "content": "# CVE-2026-69216: CVE-2026-69216: HTTP Request/Response Smuggling in http4s Ember Parser\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69216\n\n## Summary\nAn HTTP Request/Response Smuggling vulnerability (CVE-2026-69216) was identified in the Ember chunked transfer encoding decoder of the http4s Scala library. Due to parser leniency accepting sign prefixes, surrounding whitespace, and missing trailing CRLFs, attackers can bypass proxy security boundaries, poison shared caches, or hijack request queues.\n\n## TL;DR\nA lenient HTTP chunk decoder in the http4s Ember server allows TE.TE request and response smuggling attacks when combined with strict upstream reverse proxies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: Not yet calculated\n- **Impact**: Request/Response Smuggling, Cache Poisoning, Bypass of Proxy Controls\n- **Exploit Status**: None/PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s Ember Core\n- http4s Ember Server\n- http4s Ember Client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade the http4s dependencies to version 0.23.35 or 1.0.0-M47.\n- Configure front-end proxies to normalize or re-encode chunked HTTP requests.\n- Deploy HTTP/2 or HTTP/3 to avoid text-based HTTP/1.1 framing issues.\n\n**Remediation Steps:**\n1. Open your sbt build definition file (build.sbt).\n2. Identify references to org.http4s dependencies, specifically http4s-ember-server or http4s-ember-client.\n3. Update the version string to \"0.23.35\" or \"1.0.0-M47\" depending on your current major version branch.\n4. Reload the project configuration and rebuild the binary artifact to ensure the updated library is packaged.\n5. Redeploy the application and verify logs for potential ChunkedEncodingError exceptions indicating rejected malformed requests.\n\n## References\n\n- [GHSA-jrpm-956j-96jg: http4s-ember-core Request Smuggling](https://github.com/http4s/http4s/security/advisories/GHSA-jrpm-956j-96jg)\n- [Ember core fix commit d78612a5](https://github.com/http4s/http4s/commit/d78612a5abd5a2547487598d3342be05573e16f0)\n- [NVD - CVE-2026-69216](https://nvd.nist.gov/vuln/detail/CVE-2026-69216)\n- [http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69216) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T10:31:48.300472Z"}, {"uuid": "ea1607ab-98a8-4f29-8721-4d91034173b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69215", "type": "seen", "source": "https://gist.github.com/alon710/206e1d7f5d7a93ae1831f66088f759d5", "content": "# CVE-2026-69215: CVE-2026-69215: Cross-Origin Cookie Leakage via Improper Domain and Path Matching in http4s CookieJar Client Middleware\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69215\n\n## Summary\nA medium-severity cross-origin cookie leakage vulnerability exists in the CookieJar client middleware of the http4s library. Due to unanchored substring searches used to determine whether a cookie applies to an outbound request, sensitive cookies (such as session IDs and credentials) can be inadvertently sent to unauthorized domains or paths.\n\n## TL;DR\nAn unanchored substring matching flaw in http4s's CookieJar client middleware allows session cookies to be leaked to attacker-controlled origins during outbound HTTP requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-565, CWE-1275\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **EPSS Score**: Negligible\n- **Impact**: High Confidentiality Loss (Cookie Exfiltration)\n- **Exploit Status**: PoC available in test suite, no weaponized exploits in wild\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- http4s client library with CookieJar middleware enabled\n- **http4s-client**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-client**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade the http4s library to a patched version (0.23.35 or 1.0.0-M47)\n- Disable CookieJar middleware if automated cookie persistence is not required\n- Implement strict egress domain allowlisting to restrict outbound requests\n\n**Remediation Steps:**\n1. Identify any usage of http4s-client in your SBT or Maven build configurations.\n2. Verify if CookieJar middleware is utilized in client instantiation code.\n3. Update the http4s-client dependency to 0.23.35 or 1.0.0-M47 in build.sbt.\n4. Recompile the project and run vulnerability checks to ensure no vulnerable transitives remain.\n\n## References\n\n- [GitHub Security Advisory GHSA-grh8-3p95-f9rr](https://github.com/http4s/http4s/security/advisories/GHSA-grh8-3p95-f9rr)\n- [GitHub Commit c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc](https://github.com/http4s/http4s/commit/c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc)\n- [http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [NVD Detail CVE-2026-69215](https://nvd.nist.gov/vuln/detail/CVE-2026-69215)\n- [CVE.org Record CVE-2026-69215](https://www.cve.org/CVERecord?id=CVE-2026-69215)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69215) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T11:31:08.588695Z"}, {"uuid": "d6037466-0b3b-4abd-9e34-4ed89b1e2e5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69214", "type": "seen", "source": "https://gist.github.com/alon710/221abefe2acc671410201ad821c4e263", "content": "# CVE-2026-69214: CVE-2026-69214: Session Fixation via Arbitrary Set-Cookie Domain Acceptance in http4s CookieJar Middleware\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69214\n\n## Summary\nA validation flaw exists in the CookieJar client middleware of the http4s library. Prior to versions 0.23.35 and 1.0.0-M47, the middleware trusts server-supplied Domain attributes in HTTP Set-Cookie response headers without confirming that the domain matches the origin host. A malicious server can leverage this to register unauthorized cookies targeting different domains, creating potential session fixation or cookie poisoning vectors.\n\n## TL;DR\nThe http4s CookieJar client middleware accepted arbitrary cookie Domain attributes verbatim without verifying if they matched the issuing server's origin. This enables rogue servers to inject cookies for unrelated target domains in applications utilizing shared CookieJar instances.\n\n## Technical Details\n\n- **CWE ID**: CWE-384 / CWE-565\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **Exploit Maturity**: None (No public exploit modules)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Session Fixation / Cookie Tampering\n\n## Affected Systems\n\n- http4s-client\n- **http4s-client**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-client**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade http4s-client to patched versions (0.23.35 or 1.0.0-M47).\n- Isolate CookieJar contexts by creating distinct client instances for separate target domains.\n- Avoid utilizing a shared client instance when querying untrusted multi-tenant endpoints or third-party web services.\n\n**Remediation Steps:**\n1. Open the build configuration file (e.g., build.sbt).\n2. Locate the http4s-client dependency definition.\n3. Update the version number to at least 0.23.35 or 1.0.0-M47 depending on the release line.\n4. Rebuild and run dependency analysis to confirm no older vulnerable instances are loaded in the classpath.\n\n## References\n\n- [GitHub Security Advisory GHSA-wv64-j4fq-5f9x](https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x)\n- [Fix Commit 87535f7](https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f)\n- [Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [NVD CVE-2026-69214 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69214)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69214) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T12:31:32.389819Z"}, {"uuid": "7d21317e-a639-4267-b011-a7a3d12c9e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69213", "type": "seen", "source": "https://gist.github.com/alon710/27956b315c2388b848451081f38450c3", "content": "# CVE-2026-69213: CVE-2026-69213: Uncontrolled Resource Consumption (DoS) in http4s Ember HTTP/2 Implementation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69213\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CVE-2026-69213) in the http4s Ember HTTP/2 server and client implementations allows unauthenticated remote attackers to trigger an OutOfMemoryError (OOM) and cause a Denial of Service (DoS) by exploiting unbounded outbound queues.\n\n## TL;DR\nEmber HTTP/2 in http4s fails to limit outbound response queues, permitting remote attackers to crash the JVM via OutOfMemoryError by flooding control frames while stalling socket reads.\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: No Public Exploit Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- org.http4s:http4s-ember-core\n- http4s Ember HTTP/2 Server\n- http4s Ember HTTP/2 Client\n- **http4s-ember-core**: < 0.23.35 (Fixed in: `0.23.35`)\n- **http4s-ember-core**: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: `1.0.0-M47`)\n\n## Mitigation\n\n- Upgrade to http4s v0.23.35, v1.0.0-M47, or newer versions\n- Disable HTTP/2 support in Ember server configuration if not strictly necessary\n- Utilize a reverse proxy or load balancer to handle HTTP/2 connection management and write timeouts\n\n**Remediation Steps:**\n1. Locate configuration files defining the http4s Ember server or client setup.\n2. Update your project build configuration (e.g., build.sbt) to reference version 0.23.35 or 1.0.0-M47 of 'http4s-ember-core' and related modules.\n3. If updating is not possible, disable HTTP/2 by removing calls to 'withHttp2' from the server builder.\n4. Deploy or configure an upstream proxy (like Nginx or AWS ALB) to enforce aggressive read and write timeout policies on HTTP/2 sessions.\n\n## References\n\n- [GitHub Security Advisory GHSA-8f3q-3jmv-7prw](https://github.com/http4s/http4s/security/advisories/GHSA-8f3q-3jmv-7prw)\n- [GitHub Fix Commit](https://github.com/http4s/http4s/commit/13fe24d6440bde2f1eb70121486cf59c278e6bae)\n- [Http4s Release v0.23.35](https://github.com/http4s/http4s/releases/tag/v0.23.35)\n- [Http4s Release v1.0.0-M47](https://github.com/http4s/http4s/releases/tag/v1.0.0-M47)\n- [CVE Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-69213)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-69213)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69213) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T13:32:29.057218Z"}]}