# CVE-2026-69215: Http4s CookieJar middleware cookie leakage via substring matching

Source: https://junglewise.ai/threats/cve-2026-69215-http4s-cookiejar-middleware-cookie-leakage-via-substring-matching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69215 · Severity: medium · CVSS 6.8 · Published 2026-09-15

Http4s is a widely-used Scala HTTP client library. The CookieJar middleware component, which manages HTTP cookies for outbound requests, uses an incorrect domain-matching algorithm that treats cookie domains as unanchored substrings. This allows cookies intended for a domain like "example.com" to be sent to any attacker-controlled hostname containing "example.com" as a substring (e.g., "evilexample.com"), resulting in disclosure of sensitive session and authentication cookies and enabling account hijacking.

Technologies: [org.http4s:http4s-client_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-2-12), [org.http4s:http4s-client_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-2-13), [org.http4s:http4s-client_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-client-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69215 being exploited in the wild.

**How severe is CVE-2026-69215?** Medium severity, with a CVSS score of 6.8, published 15 September 2026.

**Which products and versions are affected?** Http4s-Client <= 0.23.34; org.http4s:http4s-client_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-client_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-client_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

**Is there a fix for CVE-2026-69215?** Yes. org.http4s:http4s-client_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-client_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-client_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69215 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69215?** Check whether you run Http4s-Client, org.http4s:http4s-client_2.12 (Maven), org.http4s:http4s-client_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-client_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-client_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-client_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-client_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-client_3 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-client_3 to 0.23.35 in your pom.xml or build.gradle
  ```


## Technical details

The CookieJar client middleware in Http4s uses an unanchored substring test instead of the RFC 6265 section 5.1.3 domain-matching algorithm when deciding whether to attach a cookie to an outgoing HTTP request. This means a cookie stored with domain "example.com" will be sent to any host whose name merely contains "example.com" as a substring, such as "evilexample.com" or "notexample.com.attacker.org". The vulnerability requires that the application using CookieJar can be induced to make outbound requests to an attacker-controlled host with a crafted hostname. An attacker in control of such a host can harvest session and authentication cookies, leading to session hijacking of the application's outbound calls. Patches are available: version 0.23.35 for the 0.23.x branch, and version 1.0.0-M47 for the 1.0.0-M series.

## Affected products

- http4s http4s-client_2.12 <= 0.23.34
- http4s http4s-client_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-client_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46

## Identifiers

- CVE-2026-69215
- GHSA-grh8-3p95-f9rr

## Timeline

- 2026-07-06: disclosed: Initially disclosed in http4s/http4s
- 2026-09-15: advisory: GitHub Advisory GHSA-grh8-3p95-f9rr and CVE-2026-69215 published
- 2026-09-15: patched: Patches available in version 0.23.35 and 1.0.0-M47

## References

- [https://api.github.com/users/rossabaker](https://api.github.com/users/rossabaker)
- [https://github.com/rossabaker](https://github.com/rossabaker)
- [https://api.github.com/users/rossabaker/gists%7B/gist_id%7D](https://api.github.com/users/rossabaker/gists%7B/gist_id%7D)
- [https://api.github.com/users/rossabaker/repos](https://api.github.com/users/rossabaker/repos)
- [https://avatars.githubusercontent.com/u/142698?v=4](https://avatars.githubusercontent.com/u/142698?v=4)
- [https://api.github.com/users/rossabaker/events%7B/privacy%7D](https://api.github.com/users/rossabaker/events%7B/privacy%7D)

## Related threats

- [Http4s CookieJar middleware accepts arbitrary Set-Cookie domain](https://junglewise.ai/threats/cve-2026-69214-http4s-cookiejar-middleware-accepts-arbitrary-set-cookie-domain)
- [Response Splitting from unsanitized headers](https://junglewise.ai/threats/cve-2021-41084-response-splitting-from-unsanitized-headers)