Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...