EUVD-2026-79175Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated input can therefore emit injected cookie attributes such as Domain, Path, or SameSite, widening cookie scope or weakening protections, and control characters may enable header splitting on permissive backends. The patch strips control characters from all five fields and strips semicolons from name, content, domain, and path while retaining the extension delimiter behavior. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
AnalysisAI
Cookie attribute injection in http4s's ResponseCookie.render allows any application that builds a response cookie from unvalidated input to emit attacker-controlled Domain, Path, or SameSite attributes — widening cookie scope or stripping protections — while embedded control characters can enable HTTP header splitting on permissive backends. All applications using http4s versions before 0.23.35 or 1.0.0-M47 that feed untrusted data into the name, content, domain, path, or extension fields of a ResponseCookie are in scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-113 – HTTP Response Splitting
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today