CVE-2026-69215 in Http4s
Summary
by MITRE • 09/15/2026
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Http4s, a popular Scala interface for building HTTP services, stems from an implementation flaw in the CookieJar client middleware component. Specifically, prior to version 0.23.35 and 1.0.0-M47, the logic responsible for determining whether a stored cookie should be attached to an outgoing request relied on unanchored substring matching rather than adhering strictly to RFC 6265 standards for domain and path validation. This deviation from standard protocol specifications creates a critical security gap where the middleware incorrectly identifies valid hosts based on partial string matches instead of precise hostname boundaries.
The technical consequence of this flaw is that cookies intended for legitimate domains, such as example.com, can be erroneously transmitted to maliciously controlled hostnames like evilexample.com or sub.example.evil.com if an application makes outbound requests influenced by an attacker. Because the substring check does not anchor the match to the start and end of the domain string, any hostname containing the target domain as a substring is considered valid for cookie attachment. This behavior violates the strict host matching rules defined in RFC 6265 Section 5.1.3, which require exact or subdomain-specific matches depending on whether the Domain attribute includes a leading dot.
From an operational impact perspective, this vulnerability facilitates session hijacking and credential theft. If an application uses Http4s to make outbound API calls while maintaining active sessions with other services via cookies, those sensitive authentication tokens can be leaked to attacker-controlled servers. This exposure allows adversaries to impersonate legitimate users or services by replaying the stolen cookies in subsequent requests. The risk is particularly acute for applications that handle multiple external dependencies and rely on automatic cookie management without explicit domain restrictions, as any outbound request with a manipulated host header could trigger the unintended disclosure of session data.
This issue aligns with CWE-20 Improper Input Validation, specifically regarding insufficient validation of input parameters used in security-critical decisions such as access control or credential transmission. It also maps to MITRE ATT&CK technique T1539 Steal Web Session Cookie, where attackers intercept and reuse session cookies to gain unauthorized access. The vulnerability underscores the importance of strict adherence to web standards when implementing HTTP client behaviors that handle sensitive state information like authentication tokens.
To mitigate this risk, organizations using affected versions of Http4s must upgrade immediately to version 0.23.35 or later for the 0.23 series, or version 1.0.0-M47 and later for the 1.x development branch. These releases correct the substring matching logic by implementing proper RFC 6265 compliant domain and path checks. Additionally, developers should review their application code to ensure that outbound requests are not susceptible to host header manipulation attacks, as even with the library fix, improper input validation at the request level could still pose risks in other contexts. Regular security audits of HTTP client configurations and dependency updates remain essential practices for maintaining robust web service security posture.