Detections
Analytics

SCA: security update for org.http4s:http4s-client_2.12, org.http4s:http4s-client_2.13, org.http4s:http4s-client_3 (GHSA-grh8-3p95-f9rr)

medium Tenable Cloud Security Plugin ID 447999

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client
 middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding
 whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-
 controlled hostname such as evilexample.com when an application using the same jar makes an attacker-
 influenced outbound request. This exposes session or authentication cookies and can enable hijacking of
 the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
 (CVE-2026-69215)

Solution

Update the org.http4s:http4s-client_2.12 library and its related packages to version 0.23.35 or later.

See Also

https://github.com/advisories/GHSA-grh8-3p95-f9rr

Plugin Details

Severity: Medium

ID: 447999

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/16/2026

Updated: 9/16/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-69215

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2026

Vulnerability Publication Date: 9/15/2026

Reference Information

CVE: CVE-2026-69215