CVE-2026-69215

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , its CookieJar client middleware uses unanchored substring checks instead of proper RFC 6265 domain and path matching when deciding whether to attach a stored cookie. As a result, a cookie intended for example.com can be...

CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

CVE-2026-69214

Http4s , a Scala library for HTTP services, is affected through its CookieJar client middleware . Prior to 0.23.35 and 1.0.0-M47 , the middleware stores a response cookie's Domain attribute without validating that it domain-matches the supplying host or rejecting public suffixes. A malicious or c...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

EUVD-2026-79179

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ 概述 CVE-2026-49975 是 Apache HTTP Server 中的一个拒绝服务（DoS）漏洞。 该漏洞出现在 HTTP/2 请求处理路径中，多个 cookie 头字段可以在不经过 LimitRequestFields 正确计数的情况下合并。 通过发送一个小的 HPACK 编码的 HTTP/2 请求，该请求扩展成多个 cookie 头字段，攻击者可以强制服务器在 Cookie 头合并过程中反复分配内存。 攻击者随后可利用 HTTP/2...

CVE-2023-26136

关于漏洞 CVE-2023-26136 的研究 描述 在 4.1.3 之前的 tough-cookie 包版本容易受到原型污染攻击，原因在于当 CookieJar 在 rejectPublicSuffixes=false 模式下使用时，对 cookie 的处理不当。此问题源于对象初始化方式。 目标与修复 本项目旨在提供一个修补后的 [email protected] 版本，在消除 CVE-2023-26136 漏洞的同时确保向后兼容性。 为修复该漏洞，我们修改了 memstore.js，通过使用 Object.createnull 替代标准对象初始化，确保 cookie...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 存储型XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 存储型XSS via Cookie CVE CVSS 类型 认证 https://t.me/FreeToolsCpa CVE 文件在群组 概述 字段 值 CVE ID CVE-2026-5513 漏洞类型 存储型跨站脚本（XSS） 插件 Bookly — 在线预约和预约管理系统 受影响版本 ≤ 27.2 修复版本 27.3+ CVSS 3.1 7.2（高危...

CVE-2026-91991

A flaw was found in Tornado. An attacker can bypass security validation in the setcookie function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as Domain or SameSite, and modify cookie security settings. The consequence is t...

CVE-2026-55149

Vouch Proxy is an SSO and OAuth/OIDC login gateway for Nginx. In versions prior to 0.48.0 (specifically v0.47.2), the Cookie() function in pkg/cookie/cookie.go parses the multipart cookie part count from an attacker-controlled cookie name and passes it unbounded to make([]string, N). A single una...

CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

DEBIAN-CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado (Python web framework) versions before 6.5.8 contain an incomplete fix for cookie attribute injection in the set_cookie function. An attacker can pass capitalized or legacy keyword arguments (e.g., Domain, Path, SameSite) to embed semicolon-delimited data, bypassing validation and modifyi...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...