THREAT OPS › Threat News › [GHSA] GHSA-grh8-3p95-f9rr (medium) — Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
[GHSA] GHSA-grh8-3p95-f9rr (medium) — Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
GHSA-grh8-3p95-f9rr Severity: medium CVE: CVE-2026-69215
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to
Indicators of compromise
- CVE-2026-69215cve
- evilexample.comdomain
Original source: https://github.com/advisories/GHSA-grh8-3p95-f9rr