CVE-2026-69211

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/http4s/http4s/commit/5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890
https://github.com/http4s/http4s/releases/tag/v0.23.35
https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
https://github.com/http4s/http4s/security/advisories/GHSA-7qh7-rghh-698h

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 19:17

Updated : 2026-09-16 14:17

NVD link : CVE-2026-69211

Mitre link : CVE-2026-69211

CVE.ORG link : CVE-2026-69211

JSON object : View

Products Affected

No product.

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CWE-1286

Improper Validation of Syntactic Correctness of Input

{"id": "CVE-2026-69211", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69211", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T13:55:53.661721Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "http4s", "product": "http4s", "versions": [{"status": "affected", "version": "< 0.23.35"}, {"status": "affected", "version": ">= 1.0.0-M1, < 1.0.0-M47"}]}]}], "published": "2026-09-15T19:17:38.017", "references": [{"url": "https://github.com/http4s/http4s/commit/5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890", "source": "security-advisories@github.com"}, {"url": "https://github.com/http4s/http4s/releases/tag/v0.23.35", "source": "security-advisories@github.com"}, {"url": "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47", "source": "security-advisories@github.com"}, {"url": "https://github.com/http4s/http4s/security/advisories/GHSA-7qh7-rghh-698h", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-113"}, {"lang": "en", "value": "CWE-1286"}]}], "descriptions": [{"lang": "en", "value": "Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47."}], "lastModified": "2026-09-16T14:17:07.813", "sourceIdentifier": "security-advisories@github.com"}