🔐 CVE Alert

CVE-2026-69214

MEDIUM 6.8

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CWE CWE-384 CWE-565
Vendor http4s
Product http4s
Published Sep 15, 2026
Stay Ahead of the Next One

Get instant alerts for http4s http4s

Be the first to know when new medium vulnerabilities affecting http4s http4s are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Affected Versions

http4s / http4s
< 0.23.35 >= 1.0.0-M1, < 1.0.0-M47

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x github.com: https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f github.com: https://github.com/http4s/http4s/releases/tag/v0.23.35 github.com: https://github.com/http4s/http4s/releases/tag/v1.0.0-M47