tocsin

CVE-2026-69214

3 advisories.

Maven/org.http4s:http4s-client_2.12 CVE-2026-69214: medium 6.8, EPSS 0.40%

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Action: Upgrade org.http4s:http4s-client_2.12 to 0.23.35 or later.

Affected

introducedfixedlast affected
00.23.35-

Fixed versions

0.23.35

Sources

CVE-2026-69214 · published · modified · JSON

Maven/org.http4s:http4s-client_2.13 CVE-2026-69214: medium 6.8, EPSS 0.40%

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Action: Upgrade org.http4s:http4s-client_2.13 to 0.23.35 (0.x) or 1.0.0-M47 (1.x) or later.

Affected

introducedfixedlast affected
00.23.35-
1.0.0-M11.0.0-M47-

Fixed versions

0.23.351.0.0-M47

Sources

CVE-2026-69214 · published · modified · JSON

Maven/org.http4s:http4s-client_3 CVE-2026-69214: medium 6.8, EPSS 0.40%

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Action: Upgrade org.http4s:http4s-client_3 to 0.23.35 (0.x) or 1.0.0-M47 (1.x) or later.

Affected

introducedfixedlast affected
1.0.0-M11.0.0-M47-
00.23.35-

Fixed versions

1.0.0-M470.23.35

Sources

CVE-2026-69214 · published · modified · JSON