CVE-2026-69214
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.8
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
- EPSS probability
- 0.26%
- CWE
- CWE-384, CWE-565
- Published
- 2026-09-15
- Last modified
- 2026-09-16
Affected products
- http4s http4s
- http4s http4s
Weakness type
Related vulnerabilities
- CVE-2024-11317 — PHP Session Fixation
- CVE-2024-38513 — Fiber Session Middleware Token Injection Vulnerability
- CVE-2025-59841 — FlagForgeCTF's Improper Session Handling Allows Access After Logout
- CVE-2025-52689 — Weak Session ID Check in the OmniAccess Stellar Web Management Interface
- CVE-2024-13967 — ession-Management Failure
- CVE-2024-45368 — AutomationDirect DirectLogic H2-DM1E Session Fixation
- CVE-2022-30605 — A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f
- CVE-2020-25198 — MOXA NPort IAW5000A-I/O Series