CVE-2026-69215: Http4s Cookie Domain Matching Vulnerability

CVE-2026-69215 Overview

CVE-2026-69215 is a cookie handling flaw in http4s, a Scala interface for HTTP services. The CookieJar client middleware performs unanchored substring matching instead of the RFC 6265 domain and path matching algorithm when deciding whether to attach a stored cookie to an outbound request. As a result, a cookie scoped to example.com can be transmitted to an attacker-controlled hostname such as evilexample.com. Applications that reuse a single cookie jar for attacker-influenced outbound HTTP calls may leak session or authentication cookies, enabling hijacking of the application's outbound sessions. The issue is classified under [CWE-565] (reliance on cookies without validation and integrity checking) and is fixed in http4s 0.23.35 and 1.0.0-M47.

Critical Impact
Session and authentication cookies stored in the shared CookieJar can be sent to attacker-controlled hosts, allowing hijacking of outbound sessions initiated by the vulnerable application.

Affected Products

http4s versions prior to 0.23.35
http4s versions prior to 1.0.0-M47
Any Scala application using the org.http4s.client.middleware.CookieJar middleware

Discovery Timeline

2026-09-15 - CVE-2026-69215 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-69215

Vulnerability Analysis

The CookieJar client middleware in http4s stores cookies received from server responses and reattaches them to subsequent outbound requests. RFC 6265 specifies that a stored cookie should only be sent when the request host matches the cookie's Domain attribute using anchored suffix matching, and when the request path matches the cookie's Path attribute using proper prefix rules. The vulnerable implementation instead compared host and path values using unanchored substring checks. Any request host that contains the stored cookie's domain as a substring satisfies the check, regardless of subdomain boundaries. This allows a hostname like evilexample.com to match a cookie scoped to example.com. When an application constructs outbound requests using URLs influenced by an attacker, cookies for legitimate destinations are attached to attacker-controlled hosts.

Root Cause

The root cause is a violation of RFC 6265 Section 5.1.3 (domain matching) and Section 5.1.4 (path matching) inside the CookieJar decision logic. Substring comparison replaces the required label-boundary and prefix rules, breaking the isolation that cookie scoping is meant to enforce. The patch introduces proper case-insensitive host comparison, using java.util.Locale for locale-independent lowercasing, and reimplements the RFC-compliant matching logic in client/shared/src/main/scala/org/http4s/client/middleware/CookieJar.scala.

Attack Vector

Exploitation requires an application that uses CookieJar and issues outbound HTTP requests to URLs an attacker can influence, such as user-supplied webhook targets, redirect followers, link previewers, or SSRF-adjacent flows. The attacker registers or controls a hostname whose name contains a substring of a legitimate cookie domain the application interacts with. When the application makes a request to the attacker's host, the middleware attaches the victim domain's cookies. The attacker captures the cookies from the incoming request and replays them against the legitimate service.

text

 import org.http4s._
 import org.http4s.client.Client
 
+import java.util.Locale
+
 /** Algebra for Interfacing with the Cookie Jar.
   * Allows manual intervention and eviction.
   */

Source: http4s commit c0a37f3 — the patch adds java.util.Locale and replaces substring comparisons with RFC 6265 domain and path matching in CookieJar.scala.

Detection Methods for CVE-2026-69215

Indicators of Compromise

Outbound HTTP requests from application hosts to unexpected external domains carrying Cookie headers scoped to internal or partner services.
Access log entries on legitimate services showing session reuse from unusual source IPs shortly after outbound requests to attacker-controlled hosts.
Repeated outbound requests to hostnames that share substrings with trusted domains but differ in registered suffix (for example evilexample.com versus example.com).

Detection Strategies

Perform software composition analysis (SCA) across Scala and sbt projects to flag http4s versions below 0.23.35 or 1.0.0-M47 that also enable CookieJar.
Inspect application code for use of org.http4s.client.middleware.CookieJar combined with client calls whose URLs are derived from user input.
Correlate egress proxy logs with an allowlist of expected outbound destinations to surface requests where authenticated cookies are attached to unapproved hosts.

Monitoring Recommendations

Monitor outbound HTTP traffic from services that use http4s for Cookie headers directed at hosts outside a maintained allowlist.
Alert on newly registered domains that lexically resemble internal service names appearing as outbound destinations.
Track authentication and session anomalies on downstream services that receive cookies from http4s-based clients.

How to Mitigate CVE-2026-69215

Immediate Actions Required

Upgrade http4s to 0.23.35 on the 0.23.x branch or to 1.0.0-M47 on the milestone branch.
Audit application code paths that place attacker-controllable URLs into Client calls backed by a shared CookieJar.
Rotate any session or authentication cookies that may have been transmitted to unexpected hosts prior to patching.

Patch Information

The fix is delivered in commit c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc and released in http4s v0.23.35 and http4s v1.0.0-M47. Full details are documented in GitHub Security Advisory GHSA-grh8-3p95-f9rr.

Workarounds

Remove CookieJar middleware from clients that issue requests to attacker-influenced URLs and manage cookies explicitly per destination.
Use separate Client instances with dedicated cookie jars for each trust domain rather than sharing a single jar across outbound calls.
Enforce a strict egress allowlist so that outbound HTTP requests can only reach approved hostnames.

bash

# Example sbt dependency update to the patched http4s release
# build.sbt
libraryDependencies ++= Seq(
  "org.http4s" %% "http4s-ember-client" % "0.23.35",
  "org.http4s" %% "http4s-client"       % "0.23.35"
)

# Refresh dependencies and rebuild
sbt update
sbt clean compile test