CVE-2026-69214: Http4s CookieJar Middleware Accepts Arbitrary Set-Cookie Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wv64-j4fq-5f9x",
  "modified" : "2026-09-15T20:00:44Z",
  "published" : "2026-09-15T20:00:43Z",
  "aliases" : [ "CVE-2026-69214" ],
  "summary" : "Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain",
  "details" : "When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check.  A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.\n\n## Impact\n\nSession fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.\n\n## Preconditions\n\n- Application uses the `CookieJar` client middleware.\n- Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.\n\n## Workarounds\n\n- Do not share a `CookieJar` across trusted and untrusted targets.\n\n## Note\n\nThis middleware still does not implement public suffix rejection.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-client_2.12"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-client_2.13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-client_2.13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0-M1"
      }, {
        "fixed" : "1.0.0-M47"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.0-M46"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-client_3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0-M1"
      }, {
        "fixed" : "1.0.0-M47"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.0-M46"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.http4s:http4s-client_3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.35"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.34"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/http4s/http4s"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/releases/tag/v0.23.35"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-384", "CWE-565" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-15T20:00:43Z",
    "nvd_published_at" : null
  }
}