Http4s ResponseCookie Vulnerability in Scala Interface

CVE-2026-69211

What is CVE-2026-69211?

The Http4s library, a Scala interface for HTTP services, contains a vulnerability in the ResponseCookie implementation. Specifically, prior to versions 0.23.35 and 1.0.0-M47, the library fails to neutralize semicolons and control characters when rendering cookie attributes. This oversight allows attackers to inject unvalidated input into cookies, potentially modifying attributes like Domain, Path, or SameSite. Such modifications may extend cookie scope and compromise security protections. Additionally, control characters can be exploited to perform header splitting on unsuspecting backends. The vulnerability has been addressed by a patch that sanitizes all relevant fields, including the removal of semicolons from the cookie name, content, domain, and path, while preserving the intended behavior of extension delimiters. Users are strongly advised to upgrade to the fixed versions to mitigate the risk of exploitation.

References