CVE-2026-100725

Katalog CVE

CVSS 6.5 · Medium EPSS 0,24%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.

Rincian

Terbit di NVD

27 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/http4k/http4k/commit/6a9b44d743
• https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26
• https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage