CVE-2026-69214 Details
Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
A vulnerability exists in the Http4s library's CookieJar client middleware, specifically in versions prior to 0.23.35 and 1.0.0-M47. The issue arises because the middleware accepts the Domain attribute of response cookies without proper validation, allowing malicious servers to inject cookies for arbitrary domains. These cookies can then be sent to the victim domain in subsequent requests, potentially leading to session fixation attacks or overwriting of important security cookies. The vulnerability is present when the CookieJar middleware is used to interact with untrusted servers, and the flaw has been addressed in versions 0.23.35 and 1.0.0-M47.
Users can upgrade to Http4s versions 0.23.35 or 1.0.0-M47, both of which include the necessary fix. Instructions for upgrading can be found in the Http4s release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f | [email protected] | Source CodeVendor |
| https://github.com/http4s/http4s/releases/tag/v0.23.35 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/releases/tag/v1.0.0-M47 | [email protected] | Release NotesVendor |
| https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-384 | Session Fixation | [email protected] |
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Http4s | <= 0.23.34 (semver) >= 1.0.0-M1, <= 1.0.0-M46 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |