Vulnerability Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/http4s/http4s/commit/5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890
- https://github.com/http4s/http4s/releases/tag/v0.23.35
- https://github.com/http4s/http4s/releases/tag/v1.0.0-M47
- https://github.com/http4s/http4s/security/advisories/GHSA-7qh7-rghh-698h
FAQ
What is CVE-2026-69211?
CVE-2026-69211 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing s...
How severe is CVE-2026-69211?
CVE-2026-69211 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-69211?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.