Http4s: Set-Cookie rendering does not escape attribute delimiters

published 2026-09-15 54 d ago modified 2026-09-16 53 d ago also EUVD-2026-79175

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Patch / fix

links 3

github.com/http4s/http4s@5c8e69a commit
github.com/http4s/http4s/releases/tag/v0.23.35 release
github.com/http4s/http4s/releases/tag/v1.0.0-M47 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 53 d ago (2026-09-16)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

http4s http4s

Classification

Weakness

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
CWE-1286 Improper Validation of Syntactic Correctness of Input

References

Sources

CVE List CVE-2026-69211
NVD CVE-2026-69211

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary