Executive brief
Http4s is a popular Scala HTTP client library used in many applications. The CookieJar middleware component, which manages cookies across HTTP requests, fails to validate that cookies received from a server are actually meant for the domain being accessed. An attacker running a malicious server or compromising a legitimate one can plant cookies for any domain into the cookie jar, which are then sent to that victim domain on subsequent requests—enabling account takeover through session fixation or overwriting of security-critical cookies like authentication tokens.
Technical details
The vulnerability is a cookie domain validation bypass (CWE-384: Session Fixation; CWE-565: Reliance on Cookies without Validation) in the Http4s CookieJar client middleware. When processing Set-Cookie headers from an HTTP response, the middleware trusts the server-supplied Domain attribute without validating that it domain-matches the host that sent the cookie (per RFC 6265 Section 5.3 step 6), nor does it implement public suffix list rejection. An attacker controlling or compromising any server that the application contacts via the same CookieJar can inject cookies for arbitrary domains. On the application's next request to a victim domain, these malicious cookies are automatically attached, enabling session fixation attacks or overwriting legitimate security-relevant cookies. The vulnerability requires the application to share a single CookieJar across both trusted and attacker-controlled endpoints. Patches are available in versions 0.23.35 and 1.0.0-M47 and later.
Affected products
- Http4s http4s-client_2.12 <= 0.23.34
- Http4s http4s-client_2.13 <= 0.23.34 or >= 1.0.0-M1, <= 1.0.0-M46
- Http4s http4s-client_3 <= 0.23.34 or >= 1.0.0-M1, <= 1.0.0-M46
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released in v0.23.35 and v1.0.0-M47