CVE-2026-69215
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
How to fix
- org.http4s:http4s-client_2.120.23.35 or later
- org.http4s:http4s-client_2.130.23.35, 1.0.0-M47 or later
- org.http4s:http4s-client_30.23.35, 1.0.0-M47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.http4s:http4s-client_2.12Maven | v < 0.23.35 | 0.23.35 |
| org.http4s:http4s-client_2.13Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| org.http4s:http4s-client_3Maven | v < 0.23.35, 1.0.0-M1 ≤ v < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.