Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match when UTF-8 is used. Intermediaries that apply RFC-compliant token and charset rules can therefore disagree with Ember’s Content-Length or zero-length framing, enabling TE.CL or TE.0 request smuggling, access-control bypass, cross-user request hijacking, and cache poisoning on the server path. Response smuggling through an ember-client gateway requires a malicious or compromised upstream. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Affected: Maven: org.http4s:http4s-ember-core_3, Maven: org.http4s:http4s-ember-core_2.13, Maven: org.http4s:http4s-ember-core_2.12

## Summary

Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring test (`hValue.contains("chunked")`). RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying `Transfer-Encoding: Chunked` (capital C) is therefore not recognised as chunked, and Ember falls back to framing by `Content-Length` (or zero if absent) while a compliant intermediary frames the same bytes by chunked encoding. The two parsers then disagree on where the request body ends, enabling HTTP request smuggling (TE.CL / TE.0).

The same line of code admits two further variants:

- The substring test misfires on `Transfer-Encoding: notchunked` (an inverse desync — Ember treats it as chunked while a compliant intermediary rejects the unknown coding). - Header field bytes are decoded with the platform-default charset. Under UTF-8 the wire bytes `E2 84 AA` decode to U+212A KELVIN SIGN, which `String.equalsIgnoreCase` Unicode-case-folds to `k`, so `Transfer-Encoding: chun<U+212A>ed` matches `chunked` once the comparison is made case-insensitive without also pinning the decode to ISO-8859-1.

## Impact

### Server

Request smuggling when ember-server is an origin behind an intermediary that honours `Transfer-Encoding` case-insensitively per RFC, forwards the header value verbatim, and reuses keep-alive connections to the backend:

- Front-end security bypass: the smuggled request reaches paths the intermediary…