Executive brief
Http4s is a Scala web framework library that handles HTTP cookie responses. The ResponseCookie.render function fails to properly escape cookie attribute values from untrusted input, allowing attackers to inject additional cookie attributes (such as Domain or SameSite) or control characters that could enable header splitting attacks. This can broaden cookie exposure scope or bypass security protections in web applications using the library.
Technical details
The vulnerability is a header injection flaw in the ResponseCookie.render method. The vulnerable component fails to sanitize semicolons and control characters from cookie name, content, domain, path, and extension fields before rendering them into HTTP Set-Cookie headers. An attacker who controls cookie input can inject semicolons to add arbitrary cookie attributes (e.g., Domain=attacker.com) or embed control characters to enable CRLF header splitting on permissive HTTP backends. The fix strips all control characters from all five fields and removes semicolons from name, content, domain, and path while preserving extension delimiter behavior. Patches are available in versions 0.23.35 and 1.0.0-M47.
Affected products
- http4s http4s prior to 0.23.35 and 1.0.0-M47
Timeline
- 2026-09-15: disclosed
- 2025-07-06: patched: Version 0.23.35 released