CVE-2026-69211
- Source
- https://cve.org/CVERecord?id=CVE-2026-69211
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69211.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-69211
- Aliases
-
- GHSA-7qh7-rghh-698h
- Published
- 2026-09-15T18:56:50Z
- Modified
- 2026-09-17T03:47:19Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Http4s: Set-Cookie rendering does not escape attribute delimiters
- Details
-
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-113", "CWE-1286" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69211.json" }- References
-
- https://github.com/http4s/http4s/releases/tag/v0.23.35
- https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69211.json
- https://github.com/http4s/http4s/security/advisories/GHSA-7qh7-rghh-698h
- https://nvd.nist.gov/vuln/detail/CVE-2026-69211
- https://github.com/http4s/http4s/commit/5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890
Affected packages
Git / github.com/http4s/http4s
Affected ranges
- Type
- GIT
- Repo
- https://github.com/http4s/http4s
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "0.23.35" }, { "introduced": "1.0.0-M1" }, { "fixed": "1.0.0-M47" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
v0.*
v0.23.0
v0.23.0-M1
v0.23.1
v0.23.10
v0.23.11
v0.23.12
v0.23.13
v0.23.14
v0.23.15
v0.23.16
v0.23.18
v0.23.19
v0.23.19-RC1
v0.23.19-RC2
v0.23.2
v0.23.20
v0.23.22
v0.23.23
v0.23.24
v0.23.25
v0.23.26
v0.23.27
v0.23.28
v0.23.29
v0.23.3
v0.23.30
v0.23.31
v0.23.32
v0.23.33
v0.23.34
v0.23.5
v0.23.6
v0.23.7
v0.23.8
v0.23.9
v1.*
v1.0.0-M1
v1.0.0-M10
v1.0.0-M11
v1.0.0-M12
v1.0.0-M13
v1.0.0-M15
v1.0.0-M16
v1.0.0-M17
v1.0.0-M19
v1.0.0-M2
v1.0.0-M20
v1.0.0-M21
v1.0.0-M22
v1.0.0-M24
v1.0.0-M26
v1.0.0-M28
v1.0.0-M29
v1.0.0-M3
v1.0.0-M30
v1.0.0-M31
v1.0.0-M32
v1.0.0-M33
v1.0.0-M34
v1.0.0-M35
v1.0.0-M36
v1.0.0-M37
v1.0.0-M39
v1.0.0-M4
v1.0.0-M40
v1.0.0-M41
v1.0.0-M42
v1.0.0-M43
v1.0.0-M44
v1.0.0-M45
v1.0.0-M46
v1.0.0-M5
v1.0.0-M6
v1.0.0-M7
v1.0.0-M8
v1.0.0-M9