{"id":"GHSA-wv64-j4fq-5f9x","summary":"Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain","details":"When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check.  A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.\n\n## Impact\n\nSession fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.\n\n## Preconditions\n\n- Application uses the `CookieJar` client middleware.\n- Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.\n\n## Workarounds\n\n- Do not share a `CookieJar` across trusted and untrusted targets.\n\n## Note\n\nThis middleware still does not implement public suffix rejection.","aliases":["CVE-2026-69214"],"modified":"2026-09-15T20:15:05.099141138Z","published":"2026-09-15T20:00:43Z","database_specific":{"github_reviewed_at":"2026-09-15T20:00:43Z","nvd_published_at":null,"cwe_ids":["CWE-384","CWE-565"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x"},{"type":"WEB","url":"https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"},{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v0.23.35"},{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"}],"affected":[{"package":{"name":"org.http4s:http4s-client_2.12","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.10.0-M10","0.15.0","0.15.0a","0.15.1","0.15.10","0.15.10a","0.15.11","0.15.11a","0.15.12","0.15.12a","0.15.13","0.15.13a","0.15.14","0.15.14a","0.15.15","0.15.15a","0.15.16","0.15.16a","0.15.1a","0.15.2","0.15.2a","0.15.3","0.15.3a","0.15.4","0.15.4a","0.15.5","0.15.5a","0.15.6","0.15.6a","0.15.7","0.15.7a","0.15.8","0.15.8a","0.15.9","0.15.9a","0.16.0","0.16.0-M1","0.16.0-M2","0.16.0-M3","0.16.0-RC1","0.16.0-RC2","0.16.0-RC3","0.16.0a","0.16.0a-M1","0.16.0a-M2","0.16.0a-M3","0.16.0a-RC1","0.16.0a-RC2","0.16.0a-RC3","0.16.1","0.16.1a","0.16.2","0.16.2a","0.16.3","0.16.3a","0.16.4","0.16.4a","0.16.5","0.16.5a","0.16.6","0.16.6a","0.17.0","0.17.0-M1","0.17.0-M2","0.17.0-M3","0.17.0-RC1","0.17.0-RC2","0.17.0-RC3","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.0-M1","0.18.0-M2","0.18.0-M3","0.18.0-M4","0.18.0-M5","0.18.0-M6","0.18.0-M7","0.18.0-M8","0.18.0-M9","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.19","0.18.2","0.18.20","0.18.21","0.18.22","0.18.23","0.18.24","0.18.25","0.18.26","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.0-M1","0.19.0-M2","0.19.0-M3","0.19.0-M4","0.20.0","0.20.0-M1","0.20.0-M2","0.20.0-M3","0.20.0-M4","0.20.0-M5","0.20.0-M6","0.20.0-M7","0.20.0-RC1","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.34","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.0-M1","0.22.0-M2","0.22.0-M3","0.22.0-M4","0.22.0-M5","0.22.0-M6","0.22.0-M7","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json","last_known_affected_version_range":"\u003c= 0.23.34"}},{"package":{"name":"org.http4s:http4s-client_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.10.0-M10","0.21.0","0.21.0-M1","0.21.0-M2","0.21.0-M3","0.21.0-M4","0.21.0-M5","0.21.0-M6","0.21.0-RC1","0.21.0-RC2","0.21.0-RC3","0.21.0-RC4","0.21.0-RC5","0.21.1","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.21","0.21.22","0.21.23","0.21.24","0.21.25","0.21.26","0.21.27","0.21.28","0.21.29","0.21.3","0.21.30","0.21.31","0.21.32","0.21.33","0.21.34","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22-129-24d065b","0.22-143-49b5a8d","0.22-53-01128f5","0.22-96-55d3184","0.22.0","0.22.0-M1","0.22.0-M2","0.22.0-M3","0.22.0-M4","0.22.0-M5","0.22.0-M6","0.22.0-M7","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"}},{"package":{"name":"org.http4s:http4s-client_2.13","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M47"}]}],"versions":["1.0.0-M10","1.0.0-M11","1.0.0-M13","1.0.0-M14","1.0.0-M15","1.0.0-M16","1.0.0-M17","1.0.0-M18","1.0.0-M19","1.0.0-M2","1.0.0-M20","1.0.0-M21","1.0.0-M22","1.0.0-M23","1.0.0-M24","1.0.0-M25","1.0.0-M27","1.0.0-M28","1.0.0-M29","1.0.0-M3","1.0.0-M30","1.0.0-M31","1.0.0-M32","1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M4","1.0.0-M40","1.0.0-M41","1.0.0-M42","1.0.0-M43","1.0.0-M44","1.0.0-M45","1.0.0-M46","1.0.0-M5","1.0.0-M6","1.0.0-M7","1.0.0-M8","1.0.0-M9"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.0.0-M46","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"}},{"package":{"name":"org.http4s:http4s-client_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-M1"},{"fixed":"1.0.0-M47"}]}],"versions":["1.0.0-M22","1.0.0-M23","1.0.0-M24","1.0.0-M25","1.0.0-M27","1.0.0-M28","1.0.0-M29","1.0.0-M30","1.0.0-M31","1.0.0-M32","1.0.0-M33","1.0.0-M34","1.0.0-M35","1.0.0-M36","1.0.0-M37","1.0.0-M38","1.0.0-M39","1.0.0-M40","1.0.0-M41","1.0.0-M42","1.0.0-M43","1.0.0-M44","1.0.0-M45","1.0.0-M46"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.0.0-M46","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"}},{"package":{"name":"org.http4s:http4s-client_3","ecosystem":"Maven","purl":"pkg:maven/org.http4s/http4s-client_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.35"}]}],"versions":["0.22.0","0.22.0-M8","0.22.0-RC1","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.2","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.0-M1","0.23.0-RC1","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.19-RC1","0.23.19-RC2","0.23.19-RC3","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.34","0.23.4","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}