CVE-2026-69211: Http4s: Set-Cookie rendering does not escape attribute delimiters
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using Http4s versions before 0.23.35 or 1.0.0-M47 are exposed if they construct ResponseCookie values from unvalidated input. The affected fields are the cookie name, content, domain, path, and extension.
What does an attacker need to exploit this issue?
An attacker needs influence over a value used to construct a ResponseCookie. Semicolons can inject cookie attributes in the name, content, domain, or path fields, while control characters in any affected field may enable header splitting on permissive backends.
Are applications using ResponseCookie with only trusted values affected in practice?
The vulnerable rendering behavior is present in affected versions, but exploitation described here depends on attacker-influenced values reaching ResponseCookie without validation. Applications that use only trusted, fixed cookie values do not provide the stated attacker input path.
What can be done if upgrading is not immediately possible?
Validate or sanitize all values supplied to ResponseCookie. Strip or reject control characters from name, content, domain, path, and extension, and strip or reject semicolons from name, content, domain, and path.
How can teams determine whether they are affected?
Check whether the application uses an Http4s version before 0.23.35 or 1.0.0-M47 and whether ResponseCookie fields can be populated from request-derived or otherwise untrusted input. Review cookie name, content, domain, path, and extension construction paths for semicolons and control characters.