CVE-2026-69215: Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
http4sto a version that resolves this vulnerability.Fixed in 1.0.0-M47
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications using Http4s CookieJar client middleware are exposed when they reuse a cookie jar containing cookies for a legitimate domain and make outbound requests to attacker-influenced hostnames. A hostname such as evilexample.com can receive a cookie intended for example.com.
What does an attacker need to exploit this issue?
An attacker needs to influence an outbound request made by the application using the same CookieJar. No attacker authentication or user interaction is required, but the attack depends on the application making a request to a hostname that triggers the substring match.
What should be done if patching is not immediately possible?
Avoid making attacker-influenced outbound requests with a CookieJar that contains session or authentication cookies. Separating cookie jars by trust boundary can reduce the chance that cookies for legitimate services are attached to untrusted destinations.
How can I determine whether my deployment is affected?
Check whether the application uses Http4s CookieJar client middleware and is running a version earlier than 0.23.35 or 1.0.0-M47. Also identify flows where a shared jar sends requests to attacker-controlled or otherwise untrusted hostnames.