CVE-2026-69215: Cross-Origin Cookie Leakage via Improper Domain and Path Matching in http4s CookieJar Client Middleware

Vulnerability ID: CVE-2026-69215
CVSS Score: 6.8
Published: 2026-09-15

A medium-severity cross-origin cookie leakage vulnerability exists in the CookieJar client middleware of the http4s library. Due to unanchored substring searches used to determine whether a cookie applies to an outbound request, sensitive cookies (such as session IDs and credentials) can be inadvertently sent to unauthorized domains or paths.

TL;DR

An unanchored substring matching flaw in http4s's CookieJar client middleware allows session cookies to be leaked to attacker-controlled origins during outbound HTTP requests.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-565, CWE-1275
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 6.8 (Medium)
• EPSS Score: Negligible
• Impact: High Confidentiality Loss (Cookie Exfiltration)
• Exploit Status: PoC available in test suite, no weaponized exploits in wild
• KEV Status: Not listed in CISA KEV

Affected Systems

• http4s client library with CookieJar middleware enabled
• http4s-client: < 0.23.35 (Fixed in: 0.23.35)
• http4s-client: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: c0a37f3

Fix cookie security issues in CookieJar by implementing RFC 6265 compliant matching routines

Mitigation Strategies

• Upgrade the http4s library to a patched version (0.23.35 or 1.0.0-M47)
• Disable CookieJar middleware if automated cookie persistence is not required
• Implement strict egress domain allowlisting to restrict outbound requests

Remediation Steps:

1. Identify any usage of http4s-client in your SBT or Maven build configurations.
2. Verify if CookieJar middleware is utilized in client instantiation code.
3. Update the http4s-client dependency to 0.23.35 or 1.0.0-M47 in build.sbt.
4. Recompile the project and run vulnerability checks to ensure no vulnerable transitives remain.

References

• GitHub Security Advisory GHSA-grh8-3p95-f9rr
• GitHub Commit c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc
• http4s Release v0.23.35
• http4s Release v1.0.0-M47
• NVD Detail CVE-2026-69215
• CVE.org Record CVE-2026-69215

Read the full report for CVE-2026-69215 on our website for more details including interactive diagrams and full exploit analysis.