CVE-2026-69215

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-69215

Katalog CVE

CVSS 6.8 · Medium EPSS 0,51%

Kerentanan Reliance on Cookies without Validation and Integrity Checking. Skor CVSS 3.1 6.8 (Medium) menurut github.com.

Deskripsi (NVD)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Rincian

Terbit di NVD
15 September 2026
Terakhir diubah
16 September 2026
Status NVD
Deferred
CVSS 3.1
6.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-565: Reliance on Cookies without Validation and Integrity Checking
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
EPSS (30 hari)
0,51% peluang dieksploitasi; lebih tinggi dari 41,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.