CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100725

The http4k library (Maven artifact org.http4k:http4k-core) versions before 6.48.0.0 , 5.42.0.0 , and 4.51.0.0 contains a Cookie Scoping Bypass within the BasicCookieStorage component. The vulnerability stems from a failure to enforce RFC 6265 scoping rules for cookie domains, paths, and Secure at...