# CVE-2026-69214: Http4s CookieJar middleware accepts arbitrary Set-Cookie domain

Source: https://junglewise.ai/threats/cve-2026-69214-http4s-cookiejar-middleware-accepts-arbitrary-set-cookie-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69214 · Severity: medium · CVSS 6.8 · Published 2026-09-15

Http4s is a popular Scala HTTP client library used in many applications. The CookieJar middleware component, which manages cookies across HTTP requests, fails to validate that cookies received from a server are actually meant for the domain being accessed. An attacker running a malicious server or compromising a legitimate one can plant cookies for any domain into the cookie jar, which are then sent to that victim domain on subsequent requests—enabling account takeover through session fixation or overwriting of security-critical cookies like authentication tokens.

Technologies: [org.http4s:http4s-client_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-2-12), [org.http4s:http4s-client_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-2-13), [org.http4s:http4s-client_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69214 being exploited in the wild.

**How severe is CVE-2026-69214?** Medium severity, with a CVSS score of 6.8, published 15 September 2026.

**Which products and versions are affected?** Http4s-Client <= 0.23.34; org.http4s:http4s-client_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-client_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-client_3 (Maven) ECOSYSTEM:introduced=1.0.0-M1,fixed=1.0.0-M47.

**Is there a fix for CVE-2026-69214?** Yes. org.http4s:http4s-client_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-client_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-client_3 (Maven): upgrade to 1.0.0-M47 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69214 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69214?** Check whether you run Http4s-Client, org.http4s:http4s-client_2.12 (Maven), org.http4s:http4s-client_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-client_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-client_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-client_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-client_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-client_3 (Maven): upgrade to 1.0.0-M47 or later

  ```sh
  # set org.http4s:http4s-client_3 to 1.0.0-M47 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a cookie domain validation bypass (CWE-384: Session Fixation; CWE-565: Reliance on Cookies without Validation) in the Http4s CookieJar client middleware. When processing Set-Cookie headers from an HTTP response, the middleware trusts the server-supplied Domain attribute without validating that it domain-matches the host that sent the cookie (per RFC 6265 Section 5.3 step 6), nor does it implement public suffix list rejection. An attacker controlling or compromising any server that the application contacts via the same CookieJar can inject cookies for arbitrary domains. On the application's next request to a victim domain, these malicious cookies are automatically attached, enabling session fixation attacks or overwriting legitimate security-relevant cookies. The vulnerability requires the application to share a single CookieJar across both trusted and attacker-controlled endpoints. Patches are available in versions 0.23.35 and 1.0.0-M47 and later.

## Affected products

- Http4s http4s-client_2.12 <= 0.23.34
- Http4s http4s-client_2.13 <= 0.23.34 or >= 1.0.0-M1, <= 1.0.0-M46
- Http4s http4s-client_3 <= 0.23.34 or >= 1.0.0-M1, <= 1.0.0-M46

## Identifiers

- CVE-2026-69214
- GHSA-wv64-j4fq-5f9x

## Timeline

- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-09-15: patched: Patches released in v0.23.35 and v1.0.0-M47

## References

- [https://api.github.com/users/rossabaker](https://api.github.com/users/rossabaker)
- [https://github.com/rossabaker](https://github.com/rossabaker)
- [https://api.github.com/users/rossabaker/gists%7B/gist_id%7D](https://api.github.com/users/rossabaker/gists%7B/gist_id%7D)
- [https://api.github.com/users/rossabaker/repos](https://api.github.com/users/rossabaker/repos)
- [https://avatars.githubusercontent.com/u/142698?v=4](https://avatars.githubusercontent.com/u/142698?v=4)
- [https://api.github.com/users/rossabaker/events%7B/privacy%7D](https://api.github.com/users/rossabaker/events%7B/privacy%7D)

## Related threats

- [Http4s CookieJar middleware cookie leakage via substring matching](https://junglewise.ai/threats/cve-2026-69215-http4s-cookiejar-middleware-cookie-leakage-via-substring-matching)
- [Response Splitting from unsanitized headers](https://junglewise.ai/threats/cve-2021-41084-response-splitting-from-unsanitized-headers)