CVE-2026-100725

Name of the Vulnerable Software and Affected Versions http4k versions prior to 6.48.0.0 http4k version 5.42.0.0 http4k version 4.51.0.0

Description The BasicCookieStorage (a client-side cookie store used by ClientFilters.Cookies) fails to enforce RFC 6265 scoping rules regarding the cookie domain, path, and Secure attributes. If a single BasicCookieStorage instance is used to communicate with multiple origins or schemes, cookies intended for one origin may be sent to others. Additionally, cookies marked as Secure may be transmitted over plain HTTP, which could lead to the disclosure of session cookies or other sensitive data to unauthorized hosts or network observers.

Recommendations Update http4k to a version later than 6.48.0.0. Update http4k to a version later than 5.42.0.0. Update http4k to a version later than 4.51.0.0. As a temporary mitigation, ensure that a separate BasicCookieStorage instance is used for each unique origin to prevent cross-origin cookie leakage.