GHSA-wv64-j4fq-5f9x

Suggest an improvement
Source
https://github.com/advisories/GHSA-wv64-j4fq-5f9x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wv64-j4fq-5f9x
Aliases
Published
2026-09-15T20:00:43Z
Modified
2026-09-15T20:15:05Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
Details

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 ยง5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.

Impact

Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.

Preconditions

  • Application uses the CookieJar client middleware.
  • Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.

Workarounds

  • Do not share a CookieJar across trusted and untrusted targets.

Note

This middleware still does not implement public suffix rejection.

Database specific 
{
    "cwe_ids":  [
        "CWE-384",
        "CWE-565"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-15T20:00:43Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.http4s:http4s-client_2.12

Package

Name
org.http4s:http4s-client_2.12
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-client_2.12

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.10.0-M10
0.15.0
0.15.0a
0.15.1
0.15.1a
0.15.2
0.15.2a
0.15.3
0.15.3a
0.15.4
0.15.4a
0.15.5
0.15.5a
0.15.6
0.15.6a
0.15.7
0.15.7a
0.15.8
0.15.8a
0.15.9
0.15.9a
0.15.10
0.15.10a
0.15.11
0.15.11a
0.15.12
0.15.12a
0.15.13
0.15.13a
0.15.14
0.15.14a
0.15.15
0.15.15a
0.15.16
0.15.16a
0.16.0-M1
0.16.0-M2
0.16.0-M3
0.16.0-RC1
0.16.0-RC2
0.16.0-RC3
0.16.0
0.16.0a-M1
0.16.0a-M2
0.16.0a-M3
0.16.0a-RC1
0.16.0a-RC2
0.16.0a-RC3
0.16.0a
0.16.1
0.16.1a
0.16.2
0.16.2a
0.16.3
0.16.3a
0.16.4
0.16.4a
0.16.5
0.16.5a
0.16.6
0.16.6a
0.17.0-M1
0.17.0-M2
0.17.0-M3
0.17.0-RC1
0.17.0-RC2
0.17.0-RC3
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.18.0-M1
0.18.0-M2
0.18.0-M3
0.18.0-M4
0.18.0-M5
0.18.0-M6
0.18.0-M7
0.18.0-M8
0.18.0-M9
0.18.0
0.18.1
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.15
0.18.16
0.18.17
0.18.18
0.18.19
0.18.20
0.18.21
0.18.22
0.18.23
0.18.24
0.18.25
0.18.26
0.19.0-M1
0.19.0-M2
0.19.0-M3
0.19.0-M4
0.19.0
0.20.0-M1
0.20.0-M2
0.20.0-M3
0.20.0-M4
0.20.0-M5
0.20.0-M6
0.20.0-M7
0.20.0-RC1
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.20.5
0.20.6
0.20.7
0.20.8
0.20.9
0.20.10
0.20.11
0.20.12
0.20.13
0.20.14
0.20.15
0.20.16
0.20.17
0.20.18
0.20.19
0.20.20
0.20.21
0.20.22
0.20.23
0.21.0-M1
0.21.0-M2
0.21.0-M3
0.21.0-M4
0.21.0-M5
0.21.0-M6
0.21.0-RC1
0.21.0-RC2
0.21.0-RC3
0.21.0-RC4
0.21.0-RC5
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.21.11
0.21.12
0.21.13
0.21.14
0.21.15
0.21.16
0.21.17
0.21.18
0.21.19
0.21.20
0.21.21
0.21.22
0.21.23
0.21.24
0.21.25
0.21.26
0.21.27
0.21.28
0.21.29
0.21.30
0.21.31
0.21.32
0.21.33
0.21.34
0.22.0-M1
0.22.0-M2
0.22.0-M3
0.22.0-M4
0.22.0-M5
0.22.0-M6
0.22.0-M7
0.22.0-M8
0.22.0-RC1
0.22.0
0.22-53-01128f5
0.22-96-55d3184
0.22-129-24d065b
0.22-143-49b5a8d
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"
org.http4s:http4s-client_2.13

Package

Name
org.http4s:http4s-client_2.13
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-client_2.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.10.0-M10
0.21.0-M1
0.21.0-M2
0.21.0-M3
0.21.0-M4
0.21.0-M5
0.21.0-M6
0.21.0-RC1
0.21.0-RC2
0.21.0-RC3
0.21.0-RC4
0.21.0-RC5
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.21.11
0.21.12
0.21.13
0.21.14
0.21.15
0.21.16
0.21.17
0.21.18
0.21.19
0.21.20
0.21.21
0.21.22
0.21.23
0.21.24
0.21.25
0.21.26
0.21.27
0.21.28
0.21.29
0.21.30
0.21.31
0.21.32
0.21.33
0.21.34
0.22.0-M1
0.22.0-M2
0.22.0-M3
0.22.0-M4
0.22.0-M5
0.22.0-M6
0.22.0-M7
0.22.0-M8
0.22.0-RC1
0.22.0
0.22-53-01128f5
0.22-96-55d3184
0.22-129-24d065b
0.22-143-49b5a8d
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"
org.http4s:http4s-client_2.13

Package

Name
org.http4s:http4s-client_2.13
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-client_2.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0-M1
Fixed
1.0.0-M47

Affected versions

1.*
1.0.0-M2
1.0.0-M3
1.0.0-M4
1.0.0-M5
1.0.0-M6
1.0.0-M7
1.0.0-M8
1.0.0-M9
1.0.0-M10
1.0.0-M11
1.0.0-M13
1.0.0-M14
1.0.0-M15
1.0.0-M16
1.0.0-M17
1.0.0-M18
1.0.0-M19
1.0.0-M20
1.0.0-M21
1.0.0-M22
1.0.0-M23
1.0.0-M24
1.0.0-M25
1.0.0-M27
1.0.0-M28
1.0.0-M29
1.0.0-M30
1.0.0-M31
1.0.0-M32
1.0.0-M33
1.0.0-M34
1.0.0-M35
1.0.0-M36
1.0.0-M37
1.0.0-M38
1.0.0-M39
1.0.0-M40
1.0.0-M41
1.0.0-M42
1.0.0-M43
1.0.0-M44
1.0.0-M45
1.0.0-M46

Database specific

last_known_affected_version_range 
"<= 1.0.0-M46"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"
org.http4s:http4s-client_3

Package

Name
org.http4s:http4s-client_3
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-client_3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0-M1
Fixed
1.0.0-M47

Affected versions

1.*
1.0.0-M22
1.0.0-M23
1.0.0-M24
1.0.0-M25
1.0.0-M27
1.0.0-M28
1.0.0-M29
1.0.0-M30
1.0.0-M31
1.0.0-M32
1.0.0-M33
1.0.0-M34
1.0.0-M35
1.0.0-M36
1.0.0-M37
1.0.0-M38
1.0.0-M39
1.0.0-M40
1.0.0-M41
1.0.0-M42
1.0.0-M43
1.0.0-M44
1.0.0-M45
1.0.0-M46

Database specific

last_known_affected_version_range 
"<= 1.0.0-M46"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"
org.http4s:http4s-client_3

Package

Name
org.http4s:http4s-client_3
View open source insights on deps.dev
Purl
pkg:maven/org.http4s/http4s-client_3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.23.35

Affected versions

0.*
0.22.0-M8
0.22.0-RC1
0.22.0
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.23.0-M1
0.23.0-RC1
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19-RC1
0.23.19-RC2
0.23.19-RC3
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.23.34

Database specific

last_known_affected_version_range 
"<= 0.23.34"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv64-j4fq-5f9x/GHSA-wv64-j4fq-5f9x.json"