Skip to content
Heist/ feed
Back to feed
Medium

Http4s: Set-Cookie rendering does not escape attribute delimiters

Type: advisorySources: OSV

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-69211
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 01:47 UTC · Revision 1

Source evidence

Http4s: Set-Cookie rendering does not escape attribute delimiters

core-osv · Original source

Published 15 Sept 2026, 18:56 UTC

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

osv:CVE-2026-69211
Complete source record
{
  "id": "61556b29c20c7303868daf2ed093fc49a91d4b88daa4e3b0556c220667afd7d6",
  "url": "https://osv.dev/vulnerability/CVE-2026-69211",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Http4s: Set-Cookie rendering does not escape attribute delimiters",
    "summary": "Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.",
    "evidence": "osv:CVE-2026-69211",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-69211",
      "aliases": [
        "CVE-2026-69211",
        "GHSA-7qh7-rghh-698h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/http4s/http4s",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
                },
                {
                  "introduced": "756ce63aee681c5b632bbeafe0b8fde2f3d237f4"
                },
                {
                  "fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
                },
                {
                  "fixed": "5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.23.35"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.0.0-M1"
                      },
                      {
                        "fixed": "1.0.0-M47"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a83f5f4f7e14c5b4d4a91dd71b105cbbbb391298"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.23.35"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6083780a3009bd7b26033b0ceb3d32c658b0377e"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.0.0-M47"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.0.0-M46",
            "v0.23.34",
            "v0.23.33",
            "v1.0.0-M45",
            "v0.23.32",
            "v0.23.31",
            "v1.0.0-M44",
            "v0.23.30",
            "v1.0.0-M43",
            "v1.0.0-M42",
            "v0.23.29",
            "v0.23.28",
            "v0.23.27",
            "v1.0.0-M41",
            "v0.23.26",
            "v0.23.25",
            "v0.23.24",
            "v0.23.23",
            "v1.0.0-M40",
            "v0.23.22",
            "v0.23.20",
            "v0.23.19",
            "v0.23.19-RC2",
            "v0.23.19-RC1",
            "v1.0.0-M39",
            "v0.23.18",
            "v1.0.0-M37",
            "v0.23.16",
            "v1.0.0-M36",
            "v0.23.15",
            "v1.0.0-M35",
            "v0.23.14",
            "v1.0.0-M34",
            "v0.23.13",
            "v1.0.0-M33",
            "v0.23.12",
            "v1.0.0-M32",
            "v0.23.11",
            "v1.0.0-M31",
            "v0.23.10",
            "v0.23.9",
            "v0.23.8",
            "v1.0.0-M30",
            "v0.23.7",
            "v1.0.0-M29",
            "v0.23.6",
            "v0.23.5",
            "v1.0.0-M28",
            "v0.23.3",
            "v1.0.0-M26",
            "v0.23.2",
            "v1.0.0-M24",
            "v0.23.1",
            "v0.23.0",
            "v1.0.0-M22",
            "v0.23.0-M1",
            "v1.0.0-M21",
            "v1.0.0-M20",
            "v1.0.0-M19",
            "v1.0.0-M17",
            "v1.0.0-M16",
            "v1.0.0-M15",
            "v1.0.0-M13",
            "v1.0.0-M12",
            "v1.0.0-M11",
            "v1.0.0-M10",
            "v1.0.0-M9",
            "v1.0.0-M8",
            "v1.0.0-M7",
            "v1.0.0-M6",
            "v1.0.0-M5",
            "v1.0.0-M4",
            "v1.0.0-M3",
            "v1.0.0-M2",
            "v1.0.0-M1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69211.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.552378218Z",
      "provider": "osv",
      "references": [
        "https://github.com/http4s/http4s/releases/tag/v0.23.35",
        "https://github.com/http4s/http4s/releases/tag/v1.0.0-M47",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69211.json",
        "https://github.com/http4s/http4s/security/advisories/GHSA-7qh7-rghh-698h",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-69211",
        "https://github.com/http4s/http4s/commit/5c8e69ac0f4a2fe03c3481dccd74101cd2e2a890"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-113",
          "CWE-1286"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69211.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-69211",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499480,
  "published_at": "2026-09-15T18:56:50.369+00:00"
}