CVE-2026-69214

Katalog CVE

CVSS 6.8 · Medium EPSS 0,40%

Kerentanan Session Fixation. Skor CVSS 3.1 6.8 (Medium) menurut github.com.

Deskripsi (NVD)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

16 September 2026

Status NVD

Deferred

CVSS 3.1

6.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation
CWE-565: Reliance on Cookies without Validation and Integrity Checking

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/http4s/http4s/commit/87535f7288f3baaf6736e2735087e473762b5b2f
• https://github.com/http4s/http4s/releases/tag/v0.23.35
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
• https://github.com/http4s/http4s/security/advisories/GHSA-wv64-j4fq-5f9x