CVE-2026-69214: Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using Http4s CookieJar client middleware before version 0.23.35 or 1.0.0-M47 are exposed when the same cookie jar contacts an attacker-controlled or compromised server and later makes requests to another domain.
What does an attacker need to exploit this?
An attacker needs to control, or compromise, a server that the affected client contacts through the shared CookieJar. That server can return a Set-Cookie header with a Domain attribute for a different target domain, causing the jar to later send the planted cookie to that domain.
Are fixed versions fully protected from cross-domain cookie planting?
Versions 0.23.35 and 1.0.0-M47 validate that a Set-Cookie Domain domain-matches the response origin. However, public-suffix rejection remains unimplemented.
What is the remediation?
Upgrade to Http4s version 0.23.35 or 1.0.0-M47. The fix prevents a response from setting a cookie domain that does not domain-match the host that supplied the response.