Executive brief
Http4s is a widely-used Scala HTTP client library. The CookieJar middleware component, which manages HTTP cookies for outbound requests, uses an incorrect domain-matching algorithm that treats cookie domains as unanchored substrings. This allows cookies intended for a domain like "example.com" to be sent to any attacker-controlled hostname containing "example.com" as a substring (e.g., "evilexample.com"), resulting in disclosure of sensitive session and authentication cookies and enabling account hijacking.
Technical details
The CookieJar client middleware in Http4s uses an unanchored substring test instead of the RFC 6265 section 5.1.3 domain-matching algorithm when deciding whether to attach a cookie to an outgoing HTTP request. This means a cookie stored with domain "example.com" will be sent to any host whose name merely contains "example.com" as a substring, such as "evilexample.com" or "notexample.com.attacker.org". The vulnerability requires that the application using CookieJar can be induced to make outbound requests to an attacker-controlled host with a crafted hostname. An attacker in control of such a host can harvest session and authentication cookies, leading to session hijacking of the application's outbound calls. Patches are available: version 0.23.35 for the 0.23.x branch, and version 1.0.0-M47 for the 1.0.0-M series.
Affected products
- http4s http4s-client_2.12 <= 0.23.34
- http4s http4s-client_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-client_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
Timeline
- 2026-07-06: disclosed: Initially disclosed in http4s/http4s
- 2026-09-15: advisory: GitHub Advisory GHSA-grh8-3p95-f9rr and CVE-2026-69215 published
- 2026-09-15: patched: Patches available in version 0.23.35 and 1.0.0-M47