https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 19:19:39 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-69215 <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> <p>Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.</p> https://db.gcve.eu/vuln/fkie_cve-2026-69215 https://db.gcve.eu/vuln/ghsa-grh8-3p95-f9rr <p><strong>Affected:</strong> Maven: org.http4s:http4s-client_2.12, Maven: org.http4s:http4s-client_2.13, Maven: org.http4s:http4s-client_3</p> <p>The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to any host whose name merely contains `example.com` (e.g. `evilexample.com`), leaking potentially sensitive cookies to an attacker-chosen host.</p> <p>## Impact</p> <p>Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application&#39;s outbound calls.</p> <p>## Preconditions</p> <p>- Application uses the `CookieJar` client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.</p> <p>## Workarounds</p> <p>- Do not use the `CookieJar` with clients that fetch attacker-influenced URLs - Apply a separate `CookieJar` per trusted origin.</p> <p><strong>Affected:</strong> Maven: org.http4s:http4s-client_2.12, Maven: org.http4s:http4s-client_2.13, Maven: org.http4s:http4s-client_3</p> <p>The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to any host whose name merely contains `example.com` (e.g. `evilexample.com`), leaking potentially sensitive cookies to an attacker-chosen host.</p> <p>## Impact</p> <p>Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application&#39;s outbound calls.</p> <p>## Preconditions</p> <p>- Application uses the `CookieJar` client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.</p> <p>## Workarounds</p> <p>- Do not use the `CookieJar` with clients that fetch attacker-influenced URLs - Apply a separate `CookieJar` per trusted origin.</p> https://db.gcve.eu/vuln/ghsa-grh8-3p95-f9rr