Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.
Impact
Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.
Preconditions
- Application uses the
CookieJarclient middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.
Workarounds
- Do not use the
CookieJarwith clients that fetch attacker-influenced URLs - Apply a separate
CookieJarper trusted origin.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.http4s:http4s-client_2.12 | < 0.23.35 | 0.23.35 |
| Java / Kotlin (Maven) | org.http4s:http4s-client_2.13 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
| Java / Kotlin (Maven) | org.http4s:http4s-client_3 | < 0.23.35, >= 1.0.0-M1, < 1.0.0-M47 | 0.23.35, 1.0.0-M47 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-1275, CWE-565- Platform
- Java / Kotlin (Maven)
- Package
org.http4s:http4s-client_2.12, org.http4s:http4s-client_2.13, org.http4s:http4s-client_3- Disclosed
- 15.09.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-grh8-3p95-f9rr - CC BY 4.0
Vulnerability history: org.http4s:http4s-client_3
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 09.2021 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 2
-
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.