DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69215: CVE-2026-69215: Cross-Origin Cookie Leakage via Improper Domain and Path Matching in http4s CookieJar Client Middleware

#security #cve #cybersecurity

CVE-2026-69215: Cross-Origin Cookie Leakage via Improper Domain and Path Matching in http4s CookieJar Client Middleware

Vulnerability ID: CVE-2026-69215
CVSS Score: 6.8
Published: 2026-09-15

A medium-severity cross-origin cookie leakage vulnerability exists in the CookieJar client middleware of the http4s library. Due to unanchored substring searches used to determine whether a cookie applies to an outbound request, sensitive cookies (such as session IDs and credentials) can be inadvertently sent to unauthorized domains or paths.

TL;DR

An unanchored substring matching flaw in http4s's CookieJar client middleware allows session cookies to be leaked to attacker-controlled origins during outbound HTTP requests.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-565, CWE-1275
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.8 (Medium)
  • EPSS Score: Negligible
  • Impact: High Confidentiality Loss (Cookie Exfiltration)
  • Exploit Status: PoC available in test suite, no weaponized exploits in wild
  • KEV Status: Not listed in CISA KEV

Affected Systems

  • http4s client library with CookieJar middleware enabled
  • http4s-client: < 0.23.35 (Fixed in: 0.23.35)
  • http4s-client: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: c0a37f3

Fix cookie security issues in CookieJar by implementing RFC 6265 compliant matching routines

Mitigation Strategies

  • Upgrade the http4s library to a patched version (0.23.35 or 1.0.0-M47)
  • Disable CookieJar middleware if automated cookie persistence is not required
  • Implement strict egress domain allowlisting to restrict outbound requests

Remediation Steps:

  1. Identify any usage of http4s-client in your SBT or Maven build configurations.
  2. Verify if CookieJar middleware is utilized in client instantiation code.
  3. Update the http4s-client dependency to 0.23.35 or 1.0.0-M47 in build.sbt.
  4. Recompile the project and run vulnerability checks to ensure no vulnerable transitives remain.

References

Read the full report for CVE-2026-69215 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)