{"cve":"CVE-2026-100725","nvd":{"published":"2026-09-27T02:17:20.760","modified":"2026-09-30T17:32:07.107","status":"Deferred","description":"http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by ClientFilters.Cookies) that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers. Clients that use a storage instance for a single origin are not affected.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":8.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://github.com/http4k/http4k/commit/6a9b44d743","https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26","https://www.vulncheck.com/advisories/http4k-before-6.48.0.0-cookie-scoping-bypass-via-basiccookiestorage"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2026-100725","score":0.00239,"percentile":0.14872,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-pr33-38xx-6r26","url":"https://osv.dev/vulnerability/GHSA-pr33-38xx-6r26","summary":"http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default","modified":"2026-09-27T11:56:07.811085071Z","packages":[{"ecosystem":"Maven","name":"org.http4k:http4k-core","purl":"pkg:maven/org.http4k/http4k-core","ranges":[">=6.0.0.0 <6.48.0.0"],"fixed":["6.48.0.0"]},{"ecosystem":"Maven","name":"org.http4k:http4k-core","purl":"pkg:maven/org.http4k/http4k-core","ranges":[">=5.0.0.0 <5.42.0.0"],"fixed":["5.42.0.0"]},{"ecosystem":"Maven","name":"org.http4k:http4k-core","purl":"pkg:maven/org.http4k/http4k-core","ranges":["<4.51.0.0"],"fixed":["4.51.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}