{"id":"CVE-2026-100725","aliases":["EUVD-2026-87854","GHSA-jggj-q26h-3m3c","GHSA-pr33-38xx-6r26"],"status":"published","title":"http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00239,"percentile":0.15097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-06-19T21:16:07Z","modified":"2026-10-31T02:30:37Z","fixes":[{"ecosystem":"Maven","package":"org.http4k:http4k-core","fixed_in":["6.48.0.0","5.42.0.0","4.51.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.48.0.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.42.0.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.51.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.48.0.0"}]}],"versions":["6.0.0.0","6.0.1.0","6.1.0.0","6.1.0.1","6.10.0.0","6.10.1.0","6.10.2.0","6.11.0.0","6.11.1.0","6.12.0.0","6.13.0.0","6.14.0.0","6.15.0.0","6.15.0.1","6.15.1.0","6.16.0.0","6.17.0.0","6.18.0.1","6.18.1.0","6.19.0.0","6.2.0.0","6.20.0.0","6.20.0.1","6.20.0.2","6.20.0.3","6.20.1.0","6.20.2.0","6.20.2.1","6.21.0.0","6.21.1.0","6.22.0.0","6.23.0.0","6.23.1.0","6.24.0.0","6.24.1.0","6.25.0.0","6.25.1.0","6.26.0.0","6.26.1.0","6.27.0.0","6.28.0.0","6.28.1.0","6.29.0.0","6.30.0.0","6.30.1.0","6.31.0.0","6.31.1.0","6.32.0.0","6.33.0.0","6.34.0.0","6.35.0.0","6.36.0.0","6.37.0.0","6.38.0.0","6.39.0.0","6.39.1.0","6.4.0.0","6.4.1.0","6.40.0.0","6.40.1.0","6.41.0.0","6.42.0.0","6.43.0.0","6.44.0.0","6.45.0.0","6.45.1.0","6.46.0.0","6.46.1.0","6.47.0.0","6.47.1.0","6.47.2.0","6.5.0.0","6.5.1.0","6.5.2.0","6.5.3.0","6.5.4.0","6.5.5.0","6.5.5.1","6.5.6.0","6.5.6.1","6.6.0.0","6.6.0.1","6.6.1.0","6.7.0.0","6.8.0.0","6.8.1.0","6.9.0.0","6.9.1.0","6.9.2.0"]},{"source":"osv","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.42.0.0"}]}],"versions":["5.0.0.0","5.1.0.0","5.1.1.0","5.1.1.1","5.1.2.0","5.1.2.1","5.10.0.0","5.10.1.0","5.10.2.0","5.10.3.0","5.10.4.0","5.10.5.0","5.10.6.0","5.10.7.0","5.11.0.0","5.11.1.0","5.12.0.0","5.12.1.0","5.12.2.0","5.12.2.1","5.13.0.0","5.13.0.1","5.13.1.0","5.13.2.0","5.13.4.0","5.13.4.1","5.13.5.0","5.13.6.0","5.13.6.1","5.13.7.0","5.13.8.0","5.13.9.0","5.14.0.0","5.14.1.0","5.14.2.0","5.14.4.0","5.14.5.0","5.15.0.0","5.16.0.0","5.16.1.0","5.16.2.0","5.17.0.0","5.18.1.0","5.18.2.0","5.19.0.0","5.2.0.0","5.2.1.0","5.20.0.0","5.21.0.0","5.21.1.0","5.21.2.0","5.22.0.0","5.23.0.0","5.24.0.0","5.24.1.0","5.25.0.0","5.26.0.0","5.26.1.0","5.27.0.0","5.28.0.0","5.28.1.0","5.29.0.0","5.3.0.0","5.30.0.0","5.30.1.0","5.31.0.0","5.31.1.0","5.32.0.0","5.32.1.0","5.32.2.0","5.32.3.0","5.32.4.0","5.33.0.0","5.33.0.1","5.33.1.0","5.34.0.0","5.34.1.0","5.35.0.0","5.35.1.0","5.35.2.0","5.35.3.0","5.35.4.0","5.35.5.0","5.36.0.0","5.37.0.0","5.37.1.0","5.37.1.1","5.38.0.0","5.39.0.0","5.4.0.0","5.4.1.0","5.40.0.0","5.41.0.0","5.5.0.0","5.6.0.0","5.6.1.0","5.6.2.0","5.6.2.1","5.6.3.0","5.6.4.0","5.6.5.0","5.7.1.0","5.7.2.0","5.7.3.0","5.7.4.0","5.7.5.0","5.8.0.0","5.8.1.0","5.8.2.0","5.8.3.0","5.8.4.0","5.8.5.0","5.8.5.1","5.8.6.0","5.9.0.0"]},{"source":"osv","ecosystem":"Maven","package":"org.http4k:http4k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.51.0.0"}]}],"versions":["0.21.0","0.22.0","1.0.0","1.1.0","1.10.0","1.11.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.19.1","1.2.0","1.20.0","1.21.0","1.21.1","1.22.0","1.22.2","1.23.0","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.26.2","1.27.0","1.28.0","1.3.0","1.30.0","1.31.0","1.32.0","1.32.1","1.32.2","1.33.0","1.33.1","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.10.0","2.10.1","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.17.2","2.18.0","2.18.1","2.18.2","2.18.3","2.18.5","2.19.0","2.2.0","2.2.1","2.20.0","2.21.0","2.21.1","2.21.2","2.22.0","2.23.0","2.23.2","2.23.3","2.23.4","2.24.0","2.25.0","2.25.1","2.25.2","2.25.3","2.25.4","2.26.0","2.26.1","2.26.2","2.26.3","2.27.0","2.27.1","2.27.2","2.28.0","2.29.0","2.29.1","2.29.2","2.29.3","2.29.4","2.3.0","2.30.0","2.31.0","2.31.1","2.31.2","2.31.3","2.31.4","2.32.0","2.33.0","2.33.1","2.34.0","2.35.0","2.35.1","2.36.0","2.37.0","2.38.0","2.38.1","2.4.0","2.5.0","2.5.1","2.6.0","2.7.1","2.8.0","2.8.1","2.9.0","3.0.0","3.0.1","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.100.0","3.102.0","3.102.1","3.103.0","3.103.1","3.103.2","3.104.0","3.105.0","3.106.0","3.107.0","3.108.0","3.109.0","3.11.0","3.11.1","3.110.0","3.111.0","3.112.0","3.112.1","3.112.2","3.113.0","3.114.0","3.115.0","3.115.1","3.116.0","3.117.0","3.118.0","3.119.0","3.12.0","3.120.0","3.121.0","3.122.0","3.123.0","3.124.0","3.125.0","3.126.0","3.127.0","3.128.0","3.129.0","3.13.2","3.13.3","3.13.4","3.130.0","3.131.0","3.132.0","3.133.0","3.134.0","3.135.0","3.136.0","3.137.0","3.137.1","3.138.0","3.138.1","3.139.0","3.14.0","3.14.1","3.140.0","3.141.0","3.142.0","3.143.0","3.143.1","3.144.0","3.145.0","3.146.0","3.147.0","3.148.0","3.149.0","3.15.0","3.150.0","3.151.0","3.152.0","3.153.0","3.154.0","3.154.1","3.155.0","3.156.0","3.157.0","3.157.1","3.158.0","3.158.1","3.159.0","3.16.0","3.160.0","3.160.1","3.161.0","3.162.0","3.164.0","3.165.0","3.166.0","3.166.1","3.167.0","3.169.0","3.17.0","3.17.1","3.171.0","3.172.0","3.173.0","3.175.0","3.177.0","3.178.0","3.179.0","3.179.1","3.18.0","3.18.1","3.180.0","3.182.0","3.183.0","3.185.0","3.186.0","3.187.0","3.188.0","3.189.0","3.19.0","3.190.0","3.191.0","3.192.0","3.193.0","3.193.1","3.194.0","3.195.0","3.195.1","3.196.0","3.197.0","3.198.0","3.199.0","3.199.1","3.2.1","3.2.2","3.2.3","3.20.0","3.200.0","3.201.0","3.202.0","3.203.0","3.204.0","3.205.0","3.206.0","3.207.0","3.209.0","3.21.1","3.21.2","3.210.0","3.211.0","3.212.0","3.213.0","3.214.0","3.215.0","3.216.0","3.218.0","3.219.0","3.22.2","3.22.3","3.22.4","3.220.0","3.221.0","3.222.0","3.223.0","3.224.0","3.225.0","3.226.0","3.227.0","3.229.0","3.23.0","3.23.1","3.230.0","3.231.0","3.232.0","3.233.0","3.234.0","3.235.0","3.237.0","3.238.0","3.239.0","3.24.0","3.240.0","3.241.0","3.242.0","3.243.0","3.244.0","3.245.0","3.245.1","3.246.0","3.247.0","3.248.0","3.25.0","3.250.0","3.251.0","3.252.0","3.253.0","3.254.0","3.255.0","3.256.0","3.256.1","3.257.0","3.258.0","3.259.0","3.26.0","3.26.1","3.26.2","3.26.3","3.26.4","3.26.5","3.26.6","3.260.0","3.261.0","3.262.0","3.263.0","3.264.0","3.265.0","3.266.0","3.268.0","3.269.0","3.27.0","3.270.0","3.271.0","3.272.0","3.273.0","3.274.0","3.275.0","3.276.0","3.277.0","3.278.0","3.279.0","3.28.0","3.281.0","3.283.0","3.283.1","3.284.0","3.285.0","3.285.1","3.285.2","3.29.0","3.3.0","3.3.1","3.30.0","3.31.0","3.32.0","3.32.1","3.33.0","3.33.1","3.33.2","3.34.0","3.34.1","3.34.2","3.34.3","3.35.0","3.35.1","3.35.2","3.36.0","3.36.1","3.37.0","3.37.1","3.38.0","3.38.1","3.39.1","3.39.2","3.39.3","3.39.4","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.8.0","3.9.0","3.93.4","3.94.0","3.94.1","3.95.0","3.95.1","3.96.0","3.98.0","3.99.0","4.0.0.0","4.1.0.0","4.1.1.0","4.1.1.1","4.1.1.2","4.1.2.0","4.1.2.1","4.10.0.0.0","4.10.0.1","4.10.1.0","4.11.0.0","4.11.0.1","4.12.0.0","4.12.0.1","4.12.1.0","4.12.2.0","4.12.3.0","4.12.3.1","4.13.0.0","4.13.1.0","4.13.3.0","4.13.4.0","4.14.0.0","4.14.1.0","4.14.1.1","4.14.1.2","4.14.1.3","4.14.1.4","4.15.0.0","4.16.0.0","4.16.1.0","4.16.2.0","4.16.3.0","4.17.0.0","4.17.1.0","4.17.2.0","4.17.3.0","4.17.4.0","4.17.5.0","4.17.6.0","4.17.7.0","4.17.8.0","4.17.9.0","4.18.0.0","4.19.0.0","4.19.1.0","4.19.2.0","4.19.3.0","4.19.4.0","4.19.5.0","4.2.0.0","4.20.0.0","4.20.1.0","4.20.2.0","4.21.0.0","4.21.1.0","4.21.1.1","4.22.0.0","4.22.0.1","4.23.0.0","4.24.0.0","4.25.0.0","4.25.1.0","4.25.10.0","4.25.10.1","4.25.11.0","4.25.12.0","4.25.13.0","4.25.14.0","4.25.15.0","4.25.16.0","4.25.16.1","4.25.16.2","4.25.2.0","4.25.3.0","4.25.4.0","4.25.4.1","4.25.5.0","4.25.5.1","4.25.5.2","4.25.6.0","4.25.7.0","4.25.8.0","4.25.9.0","4.26.0.0","4.27.0.0","4.27.1.0","4.27.2.0","4.27.3.0","4.27.4.0","4.28.0.0","4.28.1.0","4.28.2.0","4.29.0.0","4.29.1.0","4.3.0.0","4.3.2.0","4.3.2.1","4.3.2.2","4.3.3.0","4.3.4.0","4.3.4.1","4.3.5.1","4.3.5.2","4.3.5.3","4.3.5.4","4.30.0.0","4.30.10.0","4.30.2.0","4.30.2.1","4.30.3.0","4.30.4.0","4.30.5.0","4.30.6.0","4.30.7.0","4.30.8.0","4.30.9.0","4.31.0.0","4.32.0.0","4.32.1.0","4.32.2.0","4.32.3.0","4.32.4.0","4.33.0.0","4.33.1.0","4.33.2.0","4.33.2.1","4.33.3.0","4.34.0.0","4.34.0.1","4.34.0.2","4.34.0.3","4.34.0.4","4.34.1.0","4.34.2.0","4.34.3.0","4.34.3.1","4.34.4.0","4.35.0.0","4.35.1.0","4.35.2.0","4.35.3.0","4.35.4.0","4.36.0.0","4.37.0.0","4.38.0.0","4.38.0.1","4.39.0.0","4.4.0.0","4.4.0.1","4.4.1.0","4.4.2.0","4.40.0.0","4.40.1.0","4.40.2.0","4.41.0.0","4.41.1.0","4.41.1.1","4.41.2.0","4.41.3.0","4.41.4.0","4.42.0.0","4.42.1.0","4.43.0.0","4.43.1.0","4.44.0.0","4.44.1.0","4.45.0.0","4.46.0.0","4.47.1.0","4.47.2.0","4.48.0.0","4.48.2.0","4.5.0.0","4.5.0.1","4.6.0.0","4.7.0.0","4.7.0.1","4.7.0.2","4.7.1.0","4.8.0.0","4.8.1.0","4.8.2.0","4.9.0.0","4.9.0.1","4.9.0.2","4.9.1.0","4.9.10.0","4.9.2.0","4.9.3.0","4.9.3.1","4.9.4.0","4.9.5.0","4.9.6.0","4.9.7.0","4.9.8.0","4.9.9.0","v6.3.0.0","v6.4.1.0"]}],"products":[{"vendor":"http4k","product":"http4k"}],"references":[{"url":"https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/http4k/http4k/commit/6a9b44d743","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100725","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jggj-q26h-3m3c"},{"url":"https://datatracker.ietf.org/doc/html/rfc6265","tags":["web"]},{"url":"https://github.com/http4k/http4k/releases/tag/6.48.0.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pr33-38xx-6r26"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100725.json","tags":["advisory"]},{"url":"https://github.com/http4k/http4k","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-100725","title":"http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","status":"published","published":"2026-09-27T01:28:31.397Z","modified":"2026-10-29T21:15:26.791Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-87854","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","status":"published","published":"2026-09-27T01:28:31Z","modified":"2026-10-29T21:15:26Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:14.250155Z"}],"ghsa":[{"id":"GHSA-jggj-q26h-3m3c","title":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a...","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","status":"published","published":"2026-09-27T03:31:03Z","modified":"2026-09-27T03:31:12Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:30.689958Z"},{"id":"GHSA-pr33-38xx-6r26","title":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","description":"### Impact\n\nThe previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Secure` attribute. A client using a single storage instance to talk to multiple origins could have cookies leak across domains, or have `Secure` cookies sent over plain HTTP — the deprecation message states it bluntly: *\"BasicCookieStorage has no domain/path/scheme scoping and leaks cookies across origins. Use DefaultCookieStorage instead.\"*\n\n**Who is affected:** any client using `BasicCookieStorage` directly with cookies for more than one origin or scheme. Single-origin uses are unaffected.\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.48.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n\nThe fix introduces `DefaultCookieStorage` (RFC 6265 compliant) as the drop-in default; `BasicCookieStorage` is renamed `InsecureCookieStorage` and remains available for callers with a deliberate need for the old behaviour.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n- Use a dedicated `BasicCookieStorage` instance per origin / scheme, or\n- Switch to a separate RFC 6265-compliant cookie store implementation.\n\n### References\n\n- Fix release: [v6.48.0.0](https://github.com/http4k/http4k/releases/tag/6.48.0.0)\n- Cookie storage rewrite: [`6a9b44d743`](https://github.com/http4k/http4k/commit/6a9b44d743)\n- Background: [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265)","status":"published","published":"2026-06-19T21:16:07Z","modified":"2026-06-19T21:16:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-100725","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","status":"published","published":"2026-09-27T02:17:20.76Z","modified":"2026-10-29T21:17:06.99Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100725","title":"http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","status":"published","published":"2026-09-27T01:28:31.397Z","modified":"2026-10-31T02:30:37.056542734Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-pr33-38xx-6r26","title":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","description":"### Impact\n\nThe previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Secure` attribute. A client using a single storage instance to talk to multiple origins could have cookies leak across domains, or have `Secure` cookies sent over plain HTTP — the deprecation message states it bluntly: *\"BasicCookieStorage has no domain/path/scheme scoping and leaks cookies across origins. Use DefaultCookieStorage instead.\"*\n\n**Who is affected:** any client using `BasicCookieStorage` directly with cookies for more than one origin or scheme. Single-origin uses are unaffected.\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.48.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) |\n\nThe fix introduces `DefaultCookieStorage` (RFC 6265 compliant) as the drop-in default; `BasicCookieStorage` is renamed `InsecureCookieStorage` and remains available for callers with a deliberate need for the old behaviour.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n- Use a dedicated `BasicCookieStorage` instance per origin / scheme, or\n- Switch to a separate RFC 6265-compliant cookie store implementation.\n\n### References\n\n- Fix release: [v6.48.0.0](https://github.com/http4k/http4k/releases/tag/6.48.0.0)\n- Cookie storage rewrite: [`6a9b44d743`](https://github.com/http4k/http4k/commit/6a9b44d743)\n- Background: [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265)","status":"published","published":"2026-06-19T21:16:07Z","modified":"2026-09-27T11:56:07.811085071Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}