Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-69215

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

CVSS 3.1 6.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-69215

Published

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-69215

Published

http4s

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "http4s",
                    "product": "http4s",
                    "versions": [
                        {
                            "version": "< 0.23.35",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0-M1, < 1.0.0-M47",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON