What is the CVSS score of EUVD-2026-79190?

EUVD-2026-79190 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-79190?

Yes, a patch is available for EUVD-2026-79190. Update the affected software to the latest version immediately.

Http4S EUVD-2026-79190

| CVE-2026-69205 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-09-15 GitHub_M

GHSA-9998-894r-fwvr

Information Disclosure Request Smuggling Http4S

8.7

CVSS 3.1 · Vendor: GitHub_M

View

Vulnerability Assessment

Weakness

CWE

CWE-444

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V4 - API and Web Service HTTP request consistency

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Let me synthesize.

CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues.

Key facts:

http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47
CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling)
CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
No EPSS given, no KEV, no explicit POC.
Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217
Tags: Information Disclosure, Request Smuggling, Http4S

Fields to output. Let me write carefully.

Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine.

Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N.

Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases.

Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors.

Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream.

Exploitation conditions: Requires Ember-based server behind

Affected VersionsENISA

http4s < 0.23.35

http4s 1.0.0-M1, < 1.0.0-M47

Affected Packages

maven org.http4s:http4s-ember-core_2.12 fix: 0.23.35

maven org.http4s:http4s-ember-core_2.13 fix: 0.23.35, 1.0.0-M47

maven org.http4s:http4s-ember-core_3 fix: 0.23.35, 1.0.0-M47

euvd http4s fix: 0.23.35

euvd http4s_1_0_0_m1 fix: 1.0.0-M47

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Http4S gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Sep 15, 2026 - 20:19 EUVD

CVE Published

Sep 15, 2026 - 19:15 cve.org

HIGH 8.7

DescriptionCVE.org

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.http4s:http4s-ember-core_2.12 (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.23.35.

Technical POC Analysis

CWE-444 (inconsistent interpretation of HTTP requests).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Threat Intel

1 source

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.