Maven/org.http4s:http4s-client_2.12 CVE-2026-69215: medium 6.8, EPSS 0.51%

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Action: Upgrade org.http4s:http4s-client_2.12 to 0.23.35 or later.

Affected

Fixed versions

Sources

• osv: GHSA-grh8-3p95-f9rr
• https://github.com/http4s/http4s/security/advisories/GHSA-grh8-3p95-f9rr
• https://github.com/http4s/http4s/commit/c0a37f38d5ee2a568ba57bd9da62f8d79b8b1fcc
• https://github.com/http4s/http4s
• https://github.com/http4s/http4s/releases/tag/v0.23.35
• https://github.com/http4s/http4s/releases/tag/v1.0.0-M47

CVE-2026-69215 · published 2026-09-15T20:00:54Z · modified 2026-09-15T20:15:05.150008402Z · JSON